Minhnhut Link Gateway
Monthly
A Stored Cross-Site Scripting (XSS) vulnerability exists in the MinhNhut Link Gateway WordPress plugin versions up to and including 3.6.1, where the 'linkgate' shortcode fails to properly sanitize and escape user-supplied attributes. Authenticated attackers with Contributor-level access or higher can inject malicious JavaScript that persists in pages and executes for all users who view those pages. The vulnerability has a CVSS 3.1 score of 6.4 with a network attack vector and low complexity, indicating practical exploitability by lower-privileged authenticated users.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the MinhNhut Link Gateway WordPress plugin versions up to and including 3.6.1, where the 'linkgate' shortcode fails to properly sanitize and escape user-supplied attributes. Authenticated attackers with Contributor-level access or higher can inject malicious JavaScript that persists in pages and executes for all users who view those pages. The vulnerability has a CVSS 3.1 score of 6.4 with a network attack vector and low complexity, indicating practical exploitability by lower-privileged authenticated users.