The Internal Links Generator plugin contains an improper neutralization of input when generating web pages, allowing a reflected cross‑site scripting weakness. An attacker can supply crafted input that is echoed back in the page output without adequate sanitization, which enables the insertion of arbitrary JavaScript. This could lead to defacement, session hijacking, or malicious redirects for any visitor who loads the affected page.

The vulnerability affects the WordPress plugin Internal Links Generator made by makong. Versions up to and including 3.51 are impacted, while newer releases are not affected.

The CVSS score of 7.1 indicates a medium‑to‑high severity level. The EPSS score of less than 1% suggests that, at present, the likelihood of exploitation in the wild is low, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is exploitation via a reflected XSS payload supplied through user input or a crafted URL that the plugin renders unfiltered. Inference: an attacker could craft a link that, when clicked by a victim, executes malicious JavaScript within the victim’s browser session.