CVE-2026-16535
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Link Library WordPress plugin before version 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action.
Risk Assessment
An attacker can execute malicious script in the victim's browser, potentially leading to session theft, account takeover, or unauthorized actions in the context of the logged-in user.
Recommendation
Update the Link Library plugin to version 7.9.4 or later, which includes the sanitization and escaping fix. Additionally, educate users about the risk of clicking suspicious links.
Original NVD description (English source)
The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action.