CVE-2026-3348 Overview
CVE-2026-3348 is a Stored Cross-Site Scripting (XSS) vulnerability in the MinhNhut Link Gateway plugin for WordPress, affecting all versions up to and including 3.6.1. The flaw resides in the plugin's settings fields, including Description, Title, and other input fields, where insufficient input sanitization and output escaping allow attackers to persist arbitrary JavaScript. Authenticated attackers with Administrator-level access or higher can inject scripts that execute when users access the redirect page. The vulnerability impacts multi-site installations and installations where unfiltered_html has been disabled. The weakness is tracked as CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Administrator-level attackers on WordPress multi-site installations can persist malicious scripts in plugin settings, executing in any visitor's browser session on redirect pages.
Affected Products
- MinhNhut Link Gateway plugin for WordPress, all versions through 3.6.1
- WordPress multi-site installations running the affected plugin
- WordPress installations where the unfiltered_html capability has been disabled
Discovery Timeline
- 2026-05-27 - CVE-2026-3348 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-3348
Vulnerability Analysis
The MinhNhut Link Gateway plugin renders user-supplied values from its settings interface, including Description and Title fields, into front-end pages without applying sufficient sanitization or output escaping. When an Administrator submits content containing HTML or JavaScript, the payload persists in the WordPress database. The redirect page template then outputs these values directly into the response, causing the browser to interpret the injected markup as executable script.
This behavior is restricted to environments where WordPress strips the unfiltered_html capability from Administrators. In single-site installations with default capabilities, Administrators already possess the legitimate ability to publish HTML, which limits the privilege boundary the vulnerability crosses. On multi-site networks, however, the unfiltered_html capability is reserved for Super Administrators, making the exposure relevant to site-level Administrators.
Root Cause
The root cause is the absence of escaping functions such as esc_html(), esc_attr(), or wp_kses() around the plugin's stored settings values when they are rendered through classes.php and the templates/default/index.php template. Stored input flows from the administrative settings save path into the public-facing redirect template unchanged.
Attack Vector
An authenticated attacker holding Administrator privileges submits a malicious payload through the plugin's settings form. The payload persists in plugin options and executes whenever any visitor loads the redirect page, enabling session theft, forced administrative actions, or redirection to attacker-controlled infrastructure.
No verified exploit code is published. Implementation details are visible in the WordPress Plugin Code Implementation and the WordPress Plugin Template Code.
Detection Methods for CVE-2026-3348
Indicators of Compromise
- Unexpected <script>, onerror=, or onload= content stored in wp_options entries owned by the MinhNhut Link Gateway plugin.
- Outbound browser requests to unfamiliar domains originating from visits to the plugin's redirect page.
- Modifications to plugin settings timestamps that do not correlate with legitimate administrative activity.
Detection Strategies
- Audit plugin option rows in the WordPress database for HTML or JavaScript artifacts in Description, Title, and related fields.
- Compare current plugin settings against a known-good backup to identify unauthorized changes.
- Review web server access logs for repeated requests to redirect endpoints associated with this plugin.
Monitoring Recommendations
- Enable WordPress audit logging for option updates performed by Administrator accounts.
- Alert on Administrator logins from unexpected IP addresses or geographies on multi-site networks.
- Monitor outbound HTTP traffic from end-user sessions following access to plugin-managed redirect URLs.
How to Mitigate CVE-2026-3348
Immediate Actions Required
- Identify all WordPress multi-site installations running the MinhNhut Link Gateway plugin and inventory installed versions.
- Review current plugin settings for stored HTML or JavaScript payloads and remove any unauthorized content.
- Restrict Administrator account provisioning on multi-site networks and enforce multi-factor authentication for privileged users.
Patch Information
No patched version is listed in the available advisory data. Consult the Wordfence Vulnerability Report for the latest remediation guidance and version updates.
Workarounds
- Deactivate the MinhNhut Link Gateway plugin until a fixed release is published and verified.
- Reduce the number of Administrator accounts on affected multi-site networks and audit existing role assignments.
- Deploy a Web Application Firewall (WAF) rule to block requests containing script tags targeting plugin settings endpoints.
# Configuration example: deactivate the affected plugin via WP-CLI
wp plugin deactivate minhnhut-link-gateway --network
wp option get minhnhut_link_gateway_settings --format=json
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
