CVE-2026-3333: MinhNhut Link Gateway WordPress XSS Flaw

CVE-2026-3333 Overview

CVE-2026-3333 is a Stored Cross-Site Scripting (XSS) vulnerability in the MinhNhut Link Gateway plugin for WordPress. The flaw affects all versions up to and including 3.6.1. The plugin fails to properly sanitize input and escape output on user-supplied attributes passed to the linkgate shortcode. Authenticated users with Contributor-level access or higher can inject arbitrary web scripts into pages. The injected payload executes in the browser of any visitor who loads the affected page. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can persist JavaScript payloads that execute against administrators and site visitors, enabling session theft, redirection, and account takeover.

Affected Products

MinhNhut Link Gateway WordPress plugin, all versions through 3.6.1
WordPress sites permitting Contributor-level or higher registration
Any deployment exposing the linkgate shortcode to untrusted authenticated authors

Discovery Timeline

2026-03-21 - CVE CVE-2026-3333 published to NVD
2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-3333

Vulnerability Analysis

The MinhNhut Link Gateway plugin registers a shortcode named linkgate that accepts attributes from post content. The plugin reads these attributes and renders them into the page template without sufficient sanitization on input or escaping on output. Because shortcodes execute during page rendering, attacker-controlled attribute values flow directly into the HTML response. Any visitor who loads a post containing a malicious shortcode triggers script execution in their browser session. The scope change in the CVSS vector reflects impact extending beyond the vulnerable component to other users of the WordPress site.

Root Cause

The root cause is missing input validation and missing output escaping on shortcode attribute handling. Reviews of classes.php and templates/default/index.php in the plugin source show attribute values being concatenated into rendered output without calls to WordPress escaping helpers such as esc_attr(), esc_html(), or wp_kses(). See the WordPress Plugin Code Review and the Template Code Review for the unsafe handling.

Attack Vector

An authenticated user with Contributor permissions creates or edits a post and embeds the linkgate shortcode with malicious attribute values containing JavaScript. Once the post is published or previewed by a higher-privileged user, the script executes in their browser context. Attackers can hijack administrator sessions, perform actions on behalf of authenticated users, or redirect site visitors. No user interaction beyond loading the page is required after injection. Further technical analysis is available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-3333

Indicators of Compromise

Posts or pages containing [linkgate] shortcodes with attribute values that include <script>, onerror=, onload=, or javascript: strings
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing posts
New administrator accounts or modified user roles created without authorized change records
Database wp_posts rows with post_content containing encoded JavaScript inside linkgate parameters

Detection Strategies

Query the WordPress database for post_content containing linkgate together with HTML event handlers or <script tags
Scan plugin and theme directories for the MinhNhut Link Gateway plugin at version 3.6.1 or earlier
Review audit logs for Contributor-level accounts publishing or editing posts with shortcode content
Inspect rendered pages for unexpected inline scripts using automated DOM scanners

Monitoring Recommendations

Enable WordPress activity logging for post creation, post updates, and user role changes
Forward web server access logs and WAF events to a centralized analytics platform for shortcode pattern matching
Alert on administrator sessions originating from unusual IP addresses immediately after viewing contributor-authored content
Monitor for unexpected file modifications within wp-content/plugins/minhnhut-link-gateway/

How to Mitigate CVE-2026-3333

Immediate Actions Required

Update the MinhNhut Link Gateway plugin to a version newer than 3.6.1 once a patched release is published
Audit all Contributor, Author, and Editor accounts and remove unused or untrusted users
Review existing posts for malicious linkgate shortcode attributes and remove injected payloads
Rotate administrator passwords and invalidate active sessions if compromise is suspected

Patch Information

At the time of NVD publication on 2026-03-21, all versions through 3.6.1 are reported as affected. Site operators should consult the Wordfence Vulnerability Report for the latest patch status and apply the vendor-released fix as soon as it becomes available.

Workarounds

Deactivate and remove the MinhNhut Link Gateway plugin until a patched version is installed
Restrict the Contributor role from using shortcodes by applying a content filter that strips [linkgate] from untrusted posts
Deploy a Web Application Firewall (WAF) rule that blocks shortcode attribute values containing HTML event handlers or <script tokens
Require administrator review of all contributor-authored posts before publication

bash

# Configuration example: locate vulnerable plugin and affected posts
wp plugin list --name=minhnhut-link-gateway --fields=name,status,version
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[linkgate%' AND (post_content LIKE '%<script%' OR post_content LIKE '%onerror=%' OR post_content LIKE '%javascript:%');"
wp plugin deactivate minhnhut-link-gateway