Stored Cross-Site Scripting in MinhNhut Link Gateway Plugin for WordPress

CVE-2026-3333

What is CVE-2026-3333?

The MinhNhut Link Gateway plugin for WordPress contains a vulnerability that enables authenticated attackers, with Contributor-level access and above, to execute arbitrary web scripts across affected pages. This flaw arises from inadequate input sanitization and output escaping on user-supplied attributes within the plugin's 'linkgate' shortcode. Attackers exploiting this weakness can inject malicious scripts that compromise user security, especially when users visit pages containing injected content. It is crucial for organizations to apply patches or updates to safeguard against potential exploitation.

References