What is the CVSS score of CVE-2026-1780?

CVE-2026-1780 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-1780?

Organizations using Paid Link Manager should be aware of moderate risk from CVE-2026-1780, a cross-site scripting vulnerability rated CVSS 6.1.

How to fix or mitigate CVE-2026-1780?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Reflected Cross-Site Scriptin and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-1780

EUVD-2026-12763 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-18 Wordfence

WordPress XSS

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 18, 2026 - 04:30 euvd

EUVD-2026-12763

Analysis Generated

Mar 18, 2026 - 04:30 vuln.today

CVE Published

Mar 18, 2026 - 03:37 nvd

MEDIUM 6.1

DescriptionCVE.org

The [CR]Paid Link Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL path in all versions up to, and including, 0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

AnalysisAI

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the [CR]Paid Link Manager WordPress plugin through version 0.5, caused by insufficient input sanitization and output escaping in the URL path parameter. Unauthenticated attackers can craft malicious URLs containing arbitrary JavaScript that executes in the browsers of users who click the link, potentially leading to session hijacking, credential theft, or malware distribution. The vulnerability has a moderate CVSS score of 6.1 and requires user interaction (UI:R), but the network-accessible attack vector (AV:N) and lack of privilege requirements make it a practical threat for WordPress sites using this plugin.

Technical ContextAI

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a fundamental web application security weakness. The [CR]Paid Link Manager plugin, identified via CPE cpe:2.3:a:silentwind:[cr]paid_link_manager:*:*:*:*:*:*:*:*, is a PHP-based WordPress plugin that fails to properly escape or sanitize user-controlled input from the URL path before rendering it in HTML output. When a user visits a malicious link, the plugin processes the URL parameter without sufficient sanitization, allowing injected script tags or event handlers to execute in the victim's browser context. This is a classic reflected XSS pattern where the payload is embedded in the request itself rather than stored in a database.

RemediationAI

Users should immediately deactivate and remove the [CR]Paid Link Manager plugin from their WordPress installations if it is installed. If the plugin is essential to site operations, contact the plugin vendor (silentwind) to determine if a patched version beyond 0.5 is available. As a temporary mitigation if the plugin cannot be removed, implement a Web Application Firewall (WAF) with rules to block suspicious URL parameters and XSS payloads, enforce Content Security Policy (CSP) headers to restrict inline script execution, and educate users not to click untrusted links. Consider using alternative WordPress plugins for link management from actively maintained vendors. Review the Wordfence vulnerability advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/e5b00388-48b8-4e82-ab52-1cd3d02177b7?source=cve) for additional technical details and monitoring recommendations.