What is the CVSS score of CVE-2026-3333?

CVE-2026-3333 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3333?

Organizations using all should be aware of moderate risk from CVE-2026-3333, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-3333?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-3333

EUVD-2026-14179 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-7f6v-3gx7-27q8

GHSA-cqr2-w8jq-c675

GHSA-w5g8-5849-vj76

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14179

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The MinhNhut Link Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linkgate' shortcode in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

A Stored Cross-Site Scripting (XSS) vulnerability exists in the MinhNhut Link Gateway WordPress plugin versions up to and including 3.6.1, where the 'linkgate' shortcode fails to properly sanitize and escape user-supplied attributes. Authenticated attackers with Contributor-level access or higher can inject malicious JavaScript that persists in pages and executes for all users who view those pages. The vulnerability has a CVSS 3.1 score of 6.4 with a network attack vector and low complexity, indicating practical exploitability by lower-privileged authenticated users.

Technical ContextAI

The vulnerability is a classic Stored XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) affecting a WordPress plugin architecture. Wordpress plugins execute within the wp-admin and frontend rendering contexts, and shortcodes are processed during post/page rendering, making them a common vector for persistent XSS when attributes are not properly escaped. The affected plugin (cpe:2.3:a:minhnhut:minhnhut_link_gateway:*:*:*:*:*:*:*:*) processes shortcode attributes in classes.php (line 37) and renders them in templates/default/index.php (line 9) without adequate WordPress escaping functions like esc_attr(), esc_html(), or wp_kses_post(). The root cause is insufficient input sanitization during shortcode attribute processing combined with unescaped output during template rendering, allowing script injection in the DOM.

RemediationAI

The primary remediation is to upgrade the MinhNhut Link Gateway plugin to a version newer than 3.6.1 as soon as available from the WordPress plugin repository. If an immediate patch is not available, WordPress administrators should consider disabling or removing the plugin and evaluating alternative link gateway solutions until a patched version is released. As a temporary mitigation, restrict the Contributor role and above to trusted administrators only, review existing posts/pages for suspicious shortcode attributes, and audit user account activity for unauthorized modifications. Implement a Web Application Firewall (WAF) rule to detect and block stored XSS payloads in shortcode attributes (pattern matching for script tags or event handlers in shortcode parameters). Monitor the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/91f45973-5a98-4fdd-88fd-83b95f6d77e7?source=cve for patch availability and timeline.