The paid link manager plugin for WordPress is vulnerable to reflected cross‑site scripting via the URL path in all releases up to and including version 0.5. The flaw is caused by insufficient input sanitization and output escaping, allowing an unauthenticated attacker to inject arbitrary client‑side scripts that will execute in a victim’s browser if the victim follows a crafted link.

The vulnerability affects installations of the silentwind:[CR]Paid Link Manager plugin on WordPress sites. Every version from the initial release through 0.5 inclusive is compromised; no patch release is identified in the provided data.

The CVSS score of 6.1 indicates moderate severity. No EPSS score is available and the issue is not listed in the CISA KEV catalog, suggesting no publicly documented exploitation at this time. Exploitation requires an unauthenticated attacker to craft a malicious URL and have a user click that link, triggering the injected script in the user’s browser.