What is the CVSS score of EUVD-2026-32175?

EUVD-2026-32175 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

MinhNhut Link Gateway EUVD-2026-32175

| CVE-2026-3349 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-fhhp-v64w-7p9r

XSS WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:40 vuln.today

CVE Published

May 27, 2026 - 11:16 nvd

MEDIUM 6.1

DescriptionCVE.org

The MinhNhut Link Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter on the redirect page in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

AnalysisAI

Reflected Cross-Site Scripting in the MinhNhut Link Gateway WordPress plugin (all versions ≤ 3.6.1) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized 'url' parameter on the plugin's redirect page. Successful exploitation requires tricking a WordPress user into clicking a specially crafted link, after which the malicious script executes in the victim's browser within the scope of the WordPress site - enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit has been identified at time of analysis; EPSS stands at 0.06% (19th percentile) and CISA SSVC rates exploitation status as none, indicating minimal real-world exploitation activity at this time.

Technical ContextAI

The MinhNhut Link Gateway plugin provides URL redirect/link gateway functionality for WordPress. The CWE-79 root cause - Improper Neutralization of Input During Web Page Generation - indicates that user-controlled input (the 'url' parameter) is accepted by the plugin's redirect handler and reflected into the HTML response without sanitization or context-aware output escaping. The vulnerable code paths are precisely identified in the plugin source: classes.php at line 263 (likely the input handling/routing logic) and templates/default/index.php at line 19 (the output rendering template). The CVSS Changed Scope (S:C) component is technically significant: it confirms the injected script executes outside the plugin's own component boundary, affecting the broader WordPress application context and any credentials or tokens held within that browser session.

RemediationAI

The primary fix is to update the MinhNhut Link Gateway plugin to a version released after 3.6.1; however, no vendor-released patched version number has been confirmed in the available data - the plugin's WordPress repository page should be monitored for an updated release. If the plugin's redirect functionality is non-essential, deactivating or uninstalling the plugin entirely eliminates the attack surface with no residual risk, though this removes all link gateway features. As a compensating control pending a patch, deploying a Web Application Firewall (WAF) rule - such as a Wordfence firewall rule targeting reflected XSS patterns in the 'url' parameter on the plugin's redirect endpoint - can reduce exploitation risk; note that WAF rules may require tuning to avoid blocking legitimate redirect traffic. Developers or site operators who self-host modified versions of the plugin can apply a targeted fix at the identified source locations (classes.php:L263 and templates/default/index.php:L19) by wrapping 'url' parameter output with WordPress's esc_url() or esc_attr() functions as appropriate to context. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/c2c11644-b9b5-40c7-b558-995b621fc5d6 should be consulted for patch availability updates.