What is the CVSS score of CVE-2026-57345?

CVE-2026-57345 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Internal Links Manager are affected by CVE-2026-57345?

The Internal Links Manager WordPress plugin (versions 3.0.3 and earlier) contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious JavaScript affecting…

How to fix or mitigate CVE-2026-57345?

Within 24 hours: Inventory all WordPress installations using Internal Links Manager plugin version 3.0.3 or earlier and disable the plugin immediately if not operationally critical. Within 7 days: Complete migration to an alternative link management solution verified to be free of similar vulnerabilities, or implement a Web Application Firewall (WAF) with XSS detection rules as a temporary control. Within 30 days: Verify complete removal or replacement of Internal Links Manager plugin across all WordPress instances and implement Content Security Policy (CSP) headers to restrict JavaScript execution scope.

Internal Links Manager CVE-2026-57345

EUVD-2026-41345 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-9hgh-wp39-cw79

WordPress XSS Wordpress Plugin Internal Links Manager

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network XSS requiring victim interaction (UI:R) with scope change (S:C) into the site context, yielding limited C/I/A via script execution in the victim's browser.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:14 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Internal Links Manager <= 3.0.3 versions.

AnalysisAI

Cross-Site Scripting in the Internal Links Manager WordPress plugin (versions 3.0.3 and earlier, by webraketen) lets an unauthenticated remote attacker inject arbitrary JavaScript that executes in a victim's browser when the victim interacts with a crafted link or page. Because the CVSS scope is changed (S:C), the injected script escapes the vulnerable component's boundary and can act against other WordPress users, including administrators. There is no public exploit identified and it is not on CISA KEV, though Patchstack has publicly documented the flaw.

Technical ContextAI

The affected component is Internal Links Manager, a WordPress SEO/automated internal link-building plugin published by webraketen (CPE cpe:2.3:a:webraketen:internal_links_manager). The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation, meaning user-controllable input is reflected or stored into HTML output without adequate sanitization or output encoding. In plugins of this class the sink is typically a page, shortcode, or admin/link-management view that renders attacker-supplied data; the CVSS scope-change (S:C) indicates the script executes in the security context of the wider WordPress site rather than remaining confined to the plugin component.

RemediationAI

No vendor-released patch version is identified in the available data; because versions up to and including 3.0.3 are affected, upgrade to the next release above 3.0.3 once the vendor publishes it and confirm the fixed version against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/seo-automated-link-building/vulnerability/wordpress-internal-links-manager-plugin-3-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve) rather than assuming a version number. Until a confirmed fix ships, compensating controls include deploying a WAF or virtual patch (Patchstack and similar services offer rule-based mitigation for this specific CVE) to filter XSS payloads, disabling or restricting the plugin's public-facing link rendering if it is not business-critical, and applying a restrictive Content-Security-Policy to limit inline script execution; the trade-offs are that WAF rules can be bypassed by novel encodings, disabling the plugin removes its SEO functionality, and a strict CSP may break legitimate inline scripts elsewhere on the site. Advising administrators not to click untrusted links while authenticated reduces the UI:R-dependent risk.