Link Library EUVD-2026-54732

The Link Library WordPress plugin must be installed and active on the target site, running a version below 7.9.4. The attack vector is entirely network-based but requires user interaction - the victim must be tricked into visiting a crafted URL (UI:R per CVSS), meaning the attacker cannot exploit this passively or through automated scanning alone. No attacker authentication is required (PR:N). The impact is highest when the victim is a logged-in WordPress administrator, as session theft in that context yields site-wide compromise; if the victim is unauthenticated, impact is limited to executing script in an unprivileged browser context. WordPress sites without the Link Library plugin installed are entirely unaffected.

The CVSS 6.1 Medium rating correctly reflects limited per-impact severity (C:L/I:L) despite a Changed scope and no required authentication from the attacker. The mandatory user interaction (UI:R) is the primary friction point: the attacker must successfully deliver a crafted URL to a target and convince them to click it, making mass exploitation impractical. EPSS at 0.17% (7th percentile) is consistent with this constraint and indicates low observed exploitation probability despite the publicly available POC. The absence from CISA KEV further supports that this is not currently under active widespread exploitation. The realistic high-impact scenario is targeted phishing against WordPress administrators - where session hijacking could yield full site compromise - rather than opportunistic scanning. The low EPSS relative to POC availability suggests the POC is known but the attack friction (social engineering requirement) is suppressing observed exploitation rates.

An attacker identifies a WordPress site running Link Library below 7.9.4, crafts a URL targeting the vulnerable parameter with an embedded JavaScript payload (e.g., a cookie-stealing script), and delivers it to a logged-in WordPress administrator via a phishing email. When the administrator clicks the link, their browser executes the attacker's script in the site's origin context, allowing the attacker to exfiltrate the session cookie and hijack the administrative session. A public POC is available, reducing the skill threshold required to construct the malicious URL.