6.1
Medium
CVE-2026-16535 The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a…
Description
The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Link Library 7.9 | earliest → < 7.9.4 | 7.9.4 |
Other CVEs of Link Library
The 12 CVEs of Link Library →
CVE-2026-78396
The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set…
5.3
Medium
CVE-2026-78395
The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when…
5.3
Medium
CVE-2026-78392
The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside…
6.8
Medium
CVE-2026-78397
The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling…
4.0
Medium