What is the CVSS score of CVE-2026-3348?

CVE-2026-3348 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

MinhNhut Link Gateway CVE-2026-3348

EUVD-2026-32174 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-7gg2-vjp2-m5j2

XSS WordPress

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:38 vuln.today

CVE Published

May 27, 2026 - 11:16 nvd

MEDIUM 4.4

DescriptionCVE.org

The MinhNhut Link Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's settings (Description, Title, and other fields) in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the redirect page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AnalysisAI

Stored Cross-Site Scripting in the MinhNhut Link Gateway WordPress plugin (all versions through 3.6.1) allows authenticated administrators to persist malicious JavaScript payloads via the plugin's settings fields - including Description and Title - which then execute in the browsers of any user who accesses the plugin's redirect pages. The attack is constrained to multi-site WordPress deployments or single-site installations where unfiltered_html has been explicitly disabled, and requires Administrator-level credentials, substantially narrowing real-world exposure. No public exploit code has been identified at time of analysis, and EPSS stands at a very low 0.03% (8th percentile), consistent with the narrow exploitation window.

Technical ContextAI

The MinhNhut Link Gateway plugin for WordPress implements a link redirection feature with configurable settings. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored variant: user-supplied input accepted through settings fields is neither adequately sanitized on ingestion nor properly escaped on output. Code-level evidence is visible in the WordPress plugin repository at classes.php line 100 (input handling) and templates/default/index.php line 7 (output rendering), both referenced in NVD. The CVSS scope indicator S:C (Scope Changed) reflects that the injected script executes outside the administrative context - in the browsers of end users visiting redirect pages - crossing a security boundary between the admin panel and the public-facing site. The vulnerability is gated by WordPress's unfiltered_html capability: on standard single-site installs, Administrators possess this capability by default, which allows raw HTML/JS and bypasses sanitization hooks; the vulnerability only materializes when that capability is absent, either through a multi-site configuration (where Super Admin holds unfiltered_html exclusively) or an explicit site hardening that strips it.

RemediationAI

No vendor-released patched version has been confirmed in the available data at time of analysis. Administrators should monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b9458918-beaf-4bad-8abd-521547df9497 for an updated release. As an immediate compensating control, organizations running multi-site WordPress networks should audit which Administrator-level accounts have access to the MinhNhut Link Gateway settings page and restrict that access to trusted Super Admins only, reducing the pool of accounts that could introduce a payload. Alternatively, deactivating and removing the plugin until a patched version is released eliminates the attack surface entirely, with the trade-off of losing the link-redirect functionality. Organizations that disabled unfiltered_html on a single-site install as a hardening measure may consider whether that particular hardening is necessary, since re-enabling it for Administrators would neutralize this specific vulnerability - though that decision involves accepting other XSS-class risks from any plugin that accepts HTML input. Wordfence users with active firewall rules may receive additional protection through behavioral signatures.