The MinhNhut Link Gateway plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated administrators can inject arbitrary scripts into plugin settings fields, which are then executed in the context of users visiting the redirect pages. This vulnerability affects all versions up to and including 3.6.1 and is limited to multi-site setups or installations with unfiltered_html disabled. No official patch or remediation guidance is currently documented.

Successful exploitation allows an authenticated administrator to inject malicious scripts that execute in the browsers of users visiting the redirect pages, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The impact is limited by the requirement for administrator-level access and specific WordPress configurations (multi-site or unfiltered_html disabled). There is no indication of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the MinhNhut Link Gateway plugin in multi-site or unfiltered_html-disabled environments. Monitor vendor channels for updates or patches addressing this vulnerability.