CVE-2026-16532

CriticalCVSS 9.1

Published: 03/08/2026(UTC)Updated: 03/08/2026(UTC)Translated: 03/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The 'Link Library' WordPress plugin before version 7.9.3 does not properly sanitize and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

Risk Assessment

An unauthenticated attacker can steal, modify, or delete data from the WordPress database, including passwords and user data.

Recommendation

Update the plugin to version 7.9.3 or later, which includes security fixes.

Original NVD description (English source)

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.