Internal Links Manager < 2.1.1 - Multiple Authenticated Stored Cross-Site Scripting (XSS)

Description

Due to lack of user input filtering and validation, the "Add New Link" and "All Links" features are vulnerable to cross-site scripting.

The following fields are vulnerable: Internal Title (title), Link Title (titleattr).

Issues were reported to vendor and WP plugins team by reporter.

Edit (WPScanTeam):
July 14th, 2020 - v2.0.2 released, but Link Title field still vulnerable with another payload. WP plugins team notified.
August 18th, 2020 - No updates about bypass, disclosing.
December 27th, 2020 - v2.1.0 released, re-introducing the issue on the Internal Title (title parameter) when editing a link
January 7, 2021 - v2.1.1 released, fixing the issues