The MinhNhut Link Gateway plugin for WordPress contains a stored cross‑site scripting flaw due to insufficient input sanitization and output escaping in its settings fields such as Description and Title. An attacker who has Administrator or higher privileges can insert arbitrary JavaScript into these fields, which is then served to all users who visit the plugin’s redirect page, causing the malicious script to execute in their browsers.

All installations of MinhNhut Link Gateway version 3.6.1 or earlier are affected. The vulnerability only manifests on WordPress multi‑site networks where the unfiltered_html capability is disabled. Single‑site installations or those with unfiltered_html enabled are not impacted by this issue.

The CVSS score of 4.4 classifies this flaw as moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating it is not known to have been exploited. Exploitation requires that the attacker already has Administrator or higher access to the WordPress network; once the malicious script is stored, it is automatically delivered to all users who view the redirect page, making the attack straightforward for any privileged user who changes the plugin’s settings.