The Link Shield plugin for WordPress contains a Cross‑Site Request Forgery flaw caused by missing or incorrect nonce validation in the link_shield_menu_options() function. An unauthenticated attacker who can entice a site administrator to click a crafted link can change plugin settings and inject malicious scripts that are stored in the site. The resulting Stored Cross‑Site Scripting allows the attacker to run arbitrary code in the browsers of all visitors, compromising confidentiality and integrity of site data.

The vulnerability affects all versions of Link Shield by jconti up to and including 0.5.4, which is used within WordPress installations.

The CVSS score of 6.1 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to trick an administrator into clicking a forged request; no remote code execution or elevated privileges are required beyond the compromised admin account.