Stored Cross-Site Scripting Vulnerability in MinhNhut Link Gateway Plugin for WordPress

CVE-2026-3348

What is CVE-2026-3348?

The MinhNhut Link Gateway plugin for WordPress introduces a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping in its settings fields. This vulnerability affects all versions up to and including 3.6.1. Authenticated attackers, possessing Administrator-level access, can exploit this flaw to inject malicious web scripts, which will execute when users access the compromised redirect page. This issue poses a significant risk particularly for multi-site installations and those where unfiltered_html is disabled, allowing for unauthorized actions and potential site compromise.

References