Unauthenticated XSS in Internal Links Manager

Executive Summary

CVE-2026-57345 is a Cross Site Scripting (XSS) vulnerability found in the WordPress Internal Links Manager Plugin versions 3.0.3 and earlier.

This vulnerability allows attackers to inject malicious scripts into websites using the plugin. When visitors access the affected site, these scripts can be executed, potentially causing harmful actions such as redirects or displaying unwanted content.

The attack requires user interaction, like clicking a malicious link or visiting a specially crafted page.

The vulnerability is classified as medium priority with a CVSS score of 7.1 and falls under the OWASP Top 10 category A3: Injection.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to execute malicious scripts on your website visitors' browsers.

• Attackers can redirect visitors to malicious websites.
• Unwanted or harmful content can be displayed to users.
• It can affect the integrity and availability of your website.

Since the exploit requires user interaction, users might be tricked into clicking malicious links or visiting crafted pages that trigger the attack.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability is a Cross Site Scripting (XSS) issue in the WordPress Internal Links Manager Plugin versions 3.0.3 and earlier. Detection typically involves identifying if the vulnerable plugin version is installed and if malicious scripts are being injected or executed.

While no specific commands are provided in the resources, common detection methods include scanning the website for the plugin version and monitoring HTTP requests for suspicious script injections or unusual redirects.

For example, you can check the plugin version by accessing the WordPress plugin directory or using WP-CLI commands such as: wp plugin list | grep internal-links-manager

Additionally, monitoring web server logs or using web application firewalls (WAF) with rules to detect XSS payloads can help identify exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate recommended step is to update the WordPress Internal Links Manager Plugin to version 3.0.4 or later, where the vulnerability has been patched.

If updating immediately is not possible, applying the mitigation rule issued by Patchstack to block attacks targeting this vulnerability is advised.

Users can also seek assistance from their hosting provider or developer to implement temporary protections until the update is applied.

Useful 0 Not Useful 0