Internal Links Manager <= 3.0.3 - Unauthenticated Stored Cross-Site Scripting
high
The Internal Links Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user...
- CVSS:
- 7.2
- Affected:
- up to 3.0.3
- Fixed in:
- 3.0.4
- Disclosed:
- Jun 29, 2026
CVE-2026-57345 on NVD →
Internal Links Manager <= 3.0.1 - Cross-Site Request Forgery
medium
The Internal Links Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the link deletion functionality in the process_bulk_action() function. This makes it possible for unauthenticated attackers to...
- CVSS:
- 4.3
- Affected:
- up to 3.0.1
- Fixed in:
- 3.0.2
- Disclosed:
- Sep 19, 2025
CVE-2025-9949 on NVD →
Internal Links Manager <= 2.5.2 - Missing Authorization
medium
The Internal Links Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.
- CVSS:
- 4.3
- Affected:
- up to 2.5.2
- Fixed in:
- 2.5.3
- Disclosed:
- Jan 24, 2025
CVE-2025-24679 on NVD →
Internal Links Manager [seo-automated-link-building] < 2.5.3
unknown
[en] Missing Authorization vulnerability in webraketen Internal Links Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Internal Links Manager: from n/a through 2.5.2.
- Affected:
- up to 2.5.3
- Fixed in:
- 2.5.3
- Disclosed:
- Jan 24, 2025
CVE-2025-24679 on NVD →
Internal Links Manager [seo-automated-link-building] < 2.1.1
unknown
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities found by Chevon Phillip in WordPress Internal Links Manager plugin (versions <= 2.1.0).
- Affected:
- up to 2.1.1
- Fixed in:
- 2.1.1
- Disclosed:
- Dec 28, 2020
Internal Links Manager <= 2.1.0 - Multiple Stored Cross-Site Scripting
medium
The Internal Links Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Internal Title (title)' and 'Link Title (titleattr)' fields in versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inje...
- CVSS:
- 6.4
- Affected:
- up to 2.1.0
- Fixed in:
- 2.1.1
- Disclosed:
- Aug 18, 2020
Internal Links Manager [seo-automated-link-building] < 2.1.1
unknown
The Internal Links Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Internal Title (title)' and 'Link Title (titleattr)' fields in versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inje...
- Affected:
- up to 2.1.1
- Fixed in:
- 2.1.1
- Disclosed:
- Aug 18, 2020
Internal Links Manager [seo-automated-link-building] < 2.1.1
unknown
Due to lack of user input filtering and validation, the "Add New Link" and "All Links" features are vulnerable to cross-site scripting.
The following fields are vulnerable: Internal Title (title), Link Title (titleattr).
Issues were reported to vendor and WP plugins team by reporter.
Edit...
- Affected:
- up to 2.1.1
- Fixed in:
- 2.1.1
Internal Links Manager [seo-automated-link-building] < 3.0.2
unknown
- Affected:
- up to 3.0.2
- Fixed in:
- 3.0.2
CVE-2025-9949 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database