CVE-2026-1780

[CR]Paid Link Manager <= 0.5 - Reflected Cross-Site Scripting

Published Mar 18, 2026 CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Description

The [CR]Paid Link Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL path in all versions up to, and including, 0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Analysis

Technical impact

The paid link manager plugin for WordPress is vulnerable to reflected cross‑site scripting via the URL path in all releases up to and including version 0.5. The flaw is caused by insufficient input sanitization and output escaping, allowing an unauthenticated attacker to inject arbitrary client‑side scripts that will execute in a victim’s browser if the victim follows a crafted link.

Affected Systems

The vulnerability affects installations of the silentwind:[CR]Paid Link Manager plugin on WordPress sites. Every version from the initial release through 0.5 inclusive is compromised; no patch release is identified in the provided data.

Risk and Exploitability

The CVSS score of 6.1 indicates moderate severity. No EPSS score is available and the issue is not listed in the CISA KEV catalog, suggesting no publicly documented exploitation at this time. Exploitation requires an unauthenticated attacker to craft a malicious URL and have a user click that link, triggering the injected script in the user’s browser.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

silentwind

[CR]Paid Link Manager

unaffected

Version	Status	Constraints
`0`	affected	≤ 0.5

No data.

Vendor Product Versions

Silentwind

[cr]paid Link Manager

Version	Status	Scheme	Platform
`[0,0.5]`	affected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Check the plugin’s repository or vendor website for a newer version and upgrade immediately if available.
If no updated release exists, disable or uninstall the plugin to eliminate the vulnerability.
Verify the currently installed plugin version via the WordPress admin interface or WP‑CLI to ensure it is not affected.

Generated by OpenCVE AI on March 18, 2026 at 06:21 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.201% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/log/crpaid-link-manager/tags?rev=3479722
https://www.wordfence.com/threat-intel/vulnerabilities/id/e5b00388-48b8-4e82-ab52-1cd3d02177b7?source=cve

History

Mar 18, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 18, 2026 12:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Silentwind Silentwind [cr]paid Link Manager Wordpress Wordpress wordpress
Vendors & Products		Silentwind Silentwind [cr]paid Link Manager Wordpress Wordpress wordpress

Mar 18, 2026 4:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The [CR]Paid Link Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL path in all versions up to, and including, 0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Title		[CR]Paid Link Manager <= 0.5 - Reflected Cross-Site Scripting
Weaknesses		CWE-79
References		https://plugins.trac.wordpress.org/log/crpaid-link-manager/tags?rev=3479722 https://www.wordfence.com/threat-intel/vulnerabilities/id/e5b00388-48b8-4e82-ab52-1cd3d02177b7?source=cve
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`