The Link Fixer WordPress plugin contains a stored cross‑site scripting vulnerability in all releases up to and including 3.4. The flaw arises because broken links entered by users are not properly sanitized or escaped before being written to the database and later rendered in page content. An unauthenticated attacker can insert arbitrary JavaScript that will be persisted and executed whenever any site visitor loads a page containing the injected link. This can compromise user credentials, deface the site, or facilitate phishing attacks.

The affected asset is the WordPress plugin Link Fixer (by kpgraham) version 3.4 and earlier. These versions may be installed on any WordPress site that has the plugin activated. No other software products are directly cited as impacted.

The CVSS score of 7.2 indicates a high severity assessment. Although the EPSS score is below 1%, indicating low current exploitation probability, the vulnerability allows unauthenticated users to inject malicious payloads that run with the privileges of site visitors. The flaw is not listed in the CISA KEV catalog, but the absence of a public exploit does not mitigate the risk to sites that rely on the plugin. Attackers would need only to create a link containing malicious code; once the link is stored, every subsequent user that views the page will be affected. The lack of authentication requirements and the ability to impact a broad audience mean that, if exploited, the damage could be significant.