Link Library EUVD-2026-86527

Exploitation requires the Link Library plugin (version before 7.9.6) to be installed and its front-end directory pages to be reachable, since the flaw is in parameters reflected into link addresses generated on those pages. It is remote and unauthenticated to trigger, but limited by mandatory user interaction (UI:R): a victim must open the attacker-crafted URL, so delivery depends on phishing/social engineering. Impact is elevated when the tricked victim is a logged-in administrator. No special server configuration is needed beyond having the vulnerable plugin active with directory pages exposed.

This is a classic high-CVSS-context-but-modest-real-risk web vulnerability. The CVSS 3.1 base score of 6.1 (Medium) reflects AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - network-reachable, low complexity, no authentication, but requiring user interaction (victim must open a crafted link) and yielding only limited confidentiality/integrity impact with a scope change (script executes in the victim's browser context). All exploitation signals point to a real-but-not-urgent issue: EPSS is very low at 0.15% (4th percentile), indicating negligible predicted mass-exploitation, and there is no CISA KEV listing, so this is not confirmed as actively exploited. However, publicly available exploit code exists (WPScan disclosure), so the barrier to a targeted attack is low. There is no direct conflict among the signals - CVSS, EPSS, and the reflected-XSS nature are mutually consistent (reflected XSS is inherently a per-victim, phishing-dependent attack rather than a wormable/automatable one). The main real-world concern is the plugin author's own note that the payload can be aimed at logged-in administrators visiting the affected front-end directory pages, which raises the potential impact to session/CSRF-token theft or admin-context actions if an admin is lured to a malicious link.

An attacker crafts a URL to a Link Library front-end directory page with a malicious value in one of the unescaped parameters, so that the reflected value breaks out of a generated link address and injects script. The attacker then phishes a visitor - ideally a logged-in administrator - into clicking the link, executing JavaScript in their authenticated session to steal cookies/nonces or perform actions on their behalf. Public exploit/PoC details are available via the WPScan advisory, lowering the effort to reproduce.