The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. This allows authenticated users with Contributor or higher privileges to inject arbitrary JavaScript code via link titles. The injected scripts execute in the context of users who visit the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to 2.4.1. There is no information provided about an available patch or vendor advisory.

An attacker with Contributor-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to information disclosure, session hijacking, or other client-side impacts. The vulnerability does not affect availability and requires authenticated access, limiting its scope somewhat. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider removing or limiting the use of the ClickWhale plugin. Monitor official ClickWhale and WordPress security channels for updates and patches addressing this vulnerability.