CVE-2026-78392
Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' Parameter
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication and without checking whether the link has been published, so an unapproved submission is enough to reach any visitor who opens it.
| Vendor | unknown |
| Product | link library |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown link library
Be the first to know when new unknown vulnerabilities affecting unknown link library are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Link Library
0 < 7.9.6
References
Credits
Karthik Ramakrishnan WPScan