Unauthenticated Cross‑Site Scripting (XSS) in the Webraketen Internal Links Manager plugin allows attackers to inject malicious scripts that run in users’ browsers when they view a page containing the plugin. The vulnerability stems from insufficient sanitization of data rendered by the plugin and is present in all releases up to version 3.0.3.

Any WordPress site that has the Webraketen Internal Links Manager plugin installed at version 3.0.3 or earlier is affected. The flaw was corrected in version 3.0.4 and later, which removes the vulnerable code path.

The CVSS score of 7.1 classifies this issue as high severity. The EPSS score of less than 1% indicates a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the delivery of a malicious script via a crafted request that exploits the unsanitized output of the plugin; based on the description it is inferred that this technique does not require authentication. Attackers can embed malicious payloads into the plugin’s output, and when a site visitor loads a page containing the plugin, the script will execute in the visitor’s browser. Exploitation is straightforward: send a specially crafted request that includes payload in the plugin’s output and rely on the target’s default rendering behavior to execute the code.