Skip to main content

Link Library CVE-2026-16535

| EUVDEUVD-2026-54732 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-08-08 WPScan GHSA-gqp5-7wwf-v82x
XSS WordPress Link Library
6.1
CVSS 3.1 · Vendor: WPScan
Share

Severity by source

Vendor (WPScan) PRIMARY
6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vuln.today AI
6.1 MEDIUM

Network-delivered reflected XSS requires active victim interaction (UI:R) and executes in victim browser context crossing security boundary (S:C); no attacker authentication or special configuration needed.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

5
Analysis Generated
Aug 10, 2026 - 22:41 vuln.today
CVSS changed
Aug 10, 2026 - 20:22 NVD
6.1 (MEDIUM)
Patch available
Aug 08, 2026 - 07:01 EUVD
CVE Published
Aug 08, 2026 - 06:00 cve.org
MEDIUM 6.1
CVE Published
Aug 08, 2026 - 06:00 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action.

AnalysisAI

Reflected XSS in the Link Library WordPress plugin before 7.9.4 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL containing an unsanitized parameter. The CVSS scope is Changed (S:C), meaning attacker-controlled script runs in the victim's browsing context, enabling session theft or privilege escalation against logged-in WordPress users. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify WordPress site with Link Library plugin installed
Delivery
Craft malicious URL embedding JavaScript payload in vulnerable parameter
Exploit
Deliver URL to target victim via phishing or social engineering
Execution
Victim clicks crafted URL
Persist
Browser reflects unsanitized parameter and executes injected script
Impact
Steal session cookie or perform authenticated actions as victim
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The Link Library WordPress plugin must be installed and active on the target site, running a version below 7.9.4. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 6.1 Medium rating correctly reflects limited per-impact severity (C:L/I:L) despite a Changed scope and no required authentication from the attacker. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker identifies a WordPress site running Link Library below 7.9.4, crafts a URL targeting the vulnerable parameter with an embedded JavaScript payload (e.g., a cookie-stealing script), and delivers it to a logged-in WordPress administrator via a phishing email. When the administrator clicks the link, their browser executes the attacker's script in the site's origin context, allowing the attacker to exfiltrate the session cookie and hijack the administrative session. …
Remediation Update the Link Library WordPress plugin to version 7.9.4 or later, which introduces proper sanitization and output escaping of the affected parameter; this is a vendor-released patch confirmed available. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Link Library

View all
CVE-2026-16532 CRITICAL POC
9.1 Aug 03

Unauthenticated SQL injection in the Link Library WordPress plugin before 7.9.3 allows remote attackers to inject arbitr
CVE-2026-40779 HIGH
7.7 Jun 15

Arbitrary file deletion in the Link Library WordPress plugin (versions 7.8.8 and earlier) allows authenticated contribut
CVE-2024-29123 HIGH
7.1 Mar 19

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre L
CVE-2024-24879 HIGH
7.1 Feb 08

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre L
CVE-2024-1559 MEDIUM
6.5 Feb 20

The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'll_reciprocal' parameter in

CVE-2024-2325 MEDIUM
6.1 Apr 09

The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the searchll parameter in all

CVE-2024-4281 MEDIUM
6.4 May 08

The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'link-library' short
CVE-2026-18197 MEDIUM
6.4 Jul 29

Cross-site scripting in the Link Library WordPress plugin (versions before 7.9.4) allows unauthenticated network-based a
CVE-2024-38711 MEDIUM
6.1 Jul 20

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yannick Lef
CVE-2024-35687 MEDIUM
6.1 Jun 08

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yannick Lef
CVE-2024-24875 MEDIUM
4.3 Feb 12

Cross-Site Request Forgery (CSRF) vulnerability in Yannick Lefebvre Link Library.5.13. Rated medium severity (CVSS 4.3),
CVE-2024-13404 MEDIUM
6.1 Jan 21

The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'searchll' parameter in al

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2026-16535 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy