Link Library CVE-2026-78392

An attacker needs an account with the Contributor role or higher on a WordPress site running Link Library before 7.9.6 to inject the payload into the link field. Exploitation does not require the submission to be published or the viewer to be authenticated - the vulnerable preview renders for any visitor who opens it. Limiting factors: the attacker must obtain at least Contributor credentials (not anonymous injection), and a victim must actively open the specific crafted link preview (user interaction required), which bounds automated, unauthenticated mass exploitation.

This is a medium-severity stored XSS (input CVSS 6.8, CWE-79) that warrants scheduled rather than emergency remediation, consistent with the 'this_month' decision label. KEV status is not present, so there is no confirmed active exploitation; EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be assessed. A public PoC reference exists (WPScan) but it is not verified as working exploit code, so exploitation capability should be treated as plausible rather than proven. The signals conflict in two ways that defenders must verify: (1) the input CVSS vector lists PR:H (high privilege) while the description says the attack is reachable by 'Contributor role and above,' which is a low-privilege role - the vector likely overstates the privilege barrier and should read PR:L. (2) The input impact metrics C:H/I:H/A:H are high for a browser-context stored XSS; these appear inflated relative to the described impact. Net real-world priority is moderate: it needs an authenticated low-privilege account to plant the payload, which caps mass unauthenticated exploitation, but the preview rendering bypasses authentication and publication checks on the viewing side, widening who can be hit.

A user holding at least the Contributor role submits a Link Library entry whose link field contains a JavaScript payload; the field is output unsanitized inside a link-preview attribute. Because the preview is generated without authentication and without requiring the submission to be published, any site visitor who opens that preview executes the attacker's script in their browser. A public PoC reference (WPScan) exists but is not verified as working exploit code.