CVE-2026-57345

The Internal Links Manager plugin version 3.0.3 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

The risk includes session hijacking, administrator account takeover, and theft of sensitive data. The attack does not require authentication, increasing its reach.

Immediately update the Internal Links Manager plugin to the latest available version. If an update is not possible, consider temporarily disabling the plugin.