The vulnerability resides in the 'linkgate' shortcode of the MinhNhut Link Gateway plugin for WordPress. Because the plugin fails to sanitize or escape attributes supplied by users, a malicious contributor or higher‑privileged user can embed arbitrary JavaScript into the shortcode. This stored XSS payload is served to any visitor of the affected page, allowing attackers to hijack sessions, deface content, or deliver phishing attacks. The weakness corresponds to CWE‑79 – Improper Neutralization of Input During Web Page Generation.

WordPress sites running the MinhNhut Link Gateway plugin version 3.6.1 or earlier are affected. The plugin is distributed for the WordPress plugin ecosystem and may be present on any WordPress installation that has installed or updated it before or up to 3.6.1.

The CVSS score of 6.4 indicates medium severity; the vulnerability requires authenticated access with Contributor-level or higher privileges, so an attacker must first gain contributing authority to the WordPress site. No EPSS information is available, and the flaw is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. However, the presence of the vulnerability in a user‑facing shortcode makes it exploitable on sites where contributors can add or edit content. If privileged users are compromised or malicious, the stored payload can affect all visitors of the page. The exploit is relatively straightforward once the attacker has authorisation, as it only involves inserting a malicious shortcode into a page or post.