Skip to main content

Link Library CVE-2026-18197

| EUVDEUVD-2026-50165 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-07-29 tenable GHSA-c9gj-8f9h-hp8h
XSS Link Library
6.4
CVSS 4.0 · Vendor: tenable
Share

Severity by source

Vendor (tenable) PRIMARY
6.4 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.1 MEDIUM

Network-delivered XSS with no auth or config prerequisite; scope changes to victim browser, but direct system confidentiality/integrity impacts are low.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H

Primary rating from Vendor (tenable).

CVSS VectorVendor: tenable

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jul 29, 2026 - 08:16 vuln.today

DescriptionCVE.org

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripting (XSS).

This issue affects Link Library: before 7.9.4.

AnalysisAI

Cross-site scripting in the Link Library WordPress plugin (versions before 7.9.4) allows unauthenticated network-based attackers to inject malicious JavaScript that executes in the context of other users' browsers. The CVSS 4.0 vector assigns High subsequent-system impacts (SC:H/SI:H/SA:H), indicating exploitation could compromise visiting administrators and cascade to full WordPress site control. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Submit XSS payload via Link Library input
Delivery
Payload stored or reflected in page output
Exploit
Lure or wait for admin to visit vulnerable page
Execution
Malicious script executes in admin browser
Persist
Exfiltrate session cookie or credentials
Impact
Authenticate to WordPress admin panel as victim
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Active exploitation requires a victim user - most likely a WordPress site administrator - to actively interact with a page or content element rendered by the vulnerable Link Library plugin (UI:A per CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 6.4 is moderate, and the vector's UI:A requirement meaningfully limits opportunistic mass exploitation, as a victim must actively trigger the vulnerable page interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker submits a crafted input containing a malicious JavaScript payload through a public-facing form or parameter handled by the Link Library plugin on a target WordPress site. When a site administrator (or another authenticated user with elevated privileges) views the page or content containing the stored or reflected payload, the script executes in their browser, capturing their session cookies or credentials. …
Remediation Update the Link Library WordPress plugin to version 7.9.4 or later, available from the WordPress plugin repository at https://wordpress.org/plugins/link-library/ - this is the vendor-released patch confirmed by the advisory reference. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Link Library

View all
CVE-2026-16532 CRITICAL POC
9.1 Aug 03

Unauthenticated SQL injection in the Link Library WordPress plugin before 7.9.3 allows remote attackers to inject arbitr
CVE-2026-16535 MEDIUM POC
6.1 Aug 08

Reflected XSS in the Link Library WordPress plugin before 7.9.4 allows unauthenticated remote attackers to inject and ex
CVE-2026-40779 HIGH
7.7 Jun 15

Arbitrary file deletion in the Link Library WordPress plugin (versions 7.8.8 and earlier) allows authenticated contribut
CVE-2024-29123 HIGH
7.1 Mar 19

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre L
CVE-2024-24879 HIGH
7.1 Feb 08

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre L
CVE-2024-1559 MEDIUM
6.5 Feb 20

The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'll_reciprocal' parameter in

CVE-2024-2325 MEDIUM
6.1 Apr 09

The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the searchll parameter in all

CVE-2024-4281 MEDIUM
6.4 May 08

The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'link-library' short
CVE-2024-38711 MEDIUM
6.1 Jul 20

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yannick Lef
CVE-2024-35687 MEDIUM
6.1 Jun 08

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yannick Lef
CVE-2024-24875 MEDIUM
4.3 Feb 12

Cross-Site Request Forgery (CSRF) vulnerability in Yannick Lefebvre Link Library.5.13. Rated medium severity (CVSS 4.3),
CVE-2024-13404 MEDIUM
6.1 Jan 21

The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'searchll' parameter in al

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2026-18197 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy