The Internal Link Builder plugin for WordPress is vulnerable to stored cross‑site scripting due to insufficient input sanitization and output escaping in the plugin’s settings page. An attacker who can log in as an administrator or higher can insert arbitrary JavaScript that is saved and then executed for any user who visits a page affected by the injected code. The vulnerability is a classic client‑side injection flaw (CWE‑79) that compromises confidentiality and integrity of user sessions and can be used to hijack accounts, steal cookies, or redirect users to malicious sites.

All installations of the Internal Link Builder plugin for WordPress up to and including version 1.0 are affected. The flaw is present only on multi‑site WordPress networks or when the unfiltered_html capability is disabled. Administrators or users with equivalent privileges can exploit the plugin settings to inject malicious scripts.

The CVSS score of 4.4 indicates a moderate severity, and the EPSS score of below 1% suggests that the likelihood of exploitation is low at this time. The vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access with administrator rights and is limited to multi‑site environments where no unfiltered input is allowed. Once injected, the malicious script runs automatically whenever a user opens an affected page, providing a persistent cross‑site scripting attack vector.