The myLinksDump plugin for WordPress contains a stored XSS flaw because the link_title parameter is neither sanitized nor properly escaped. An attacker who has administrator or higher rights can place arbitrary JavaScript code into that field. When the affected page is subsequently viewed by any user, the injected script runs in the victim’s browser, allowing the attacker to hijack sessions, steal cookies, redirect users, or deliver malware. The vulnerability is a classic input validation and output encoding mistake (CWE‑79).

WordPress sites that use myLinksDump versions 1.6 or earlier on a multi‑site installation and where the unfiltered_html capability is not enabled are impacted. The flaw does not apply to single‑site WordPress setups or to installations that have migrated to a newer major version of the plugin.

The CVSS score is 4.8, indicating moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting no publicly announced exploitation yet. The exploitation path requires an authenticated administrator; there are no known public exploits, but the attack vector is feasible as long as the plugin remains installed in a vulnerable state.