Description

The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pages, leading to Reflected Cross-Site Scripting which could be used against any visitor, including logged-in administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-25T07:16:54.327Z",
  "pubdate": "2026-09-25T07:16:54.327Z",
  "executiveSummary": "The Link Library WordPress plugin, specifically versions prior to 7.9.6, is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability exists due to improper input sanitization and output encoding of specific parameters used within the generated link addresses on front-end directory pages.\nAn unauthenticated attacker can exploit this flaw by crafting malicious URLs containing arbitrary JavaScript payloads.\nWhen a victim, including high-privileged users such as administrators, interacts with the compromised link, the malicious script executes within the context of the user's browser session.\nThe primary risk involves unauthorized actions performed on behalf of the victim, session hijacking, credential theft, or the defacement of the directory pages.\nThe vulnerability is accessible remotely via the web interface and requires no prior authentication to initiate an attack vector.\nSuccessful exploitation depends on the victim clicking or navigating to the crafted URL, making it a social engineering-dependent attack surface.",
  "technicalDetails": "The vulnerability originates from a failure to perform adequate context-aware output encoding on parameters processed by the Link Library plugin before they are rendered in the HTML document object model (DOM).\nSpecifically, the affected component processes URL parameters that are subsequently reflected in the href attributes or adjacent text elements of links within the front-end directory pages.\nBecause the application does not validate or escape these inputs against cross-site scripting patterns, the browser interprets user-supplied strings as executable code rather than plain text data.\nThe attack flow begins when an attacker identifies a reflection point within the directory page where query parameters are echoed back to the user. The attacker constructs a malicious URL incorporating a JavaScript URI scheme, such as 'javascript:alert(document.cookie)', or attempts to break out of existing HTML attributes by injecting event handlers like 'onmouseover' or 'onerror'.\nWhen the target victim visits the crafted URL, the server-side application echoes the malicious parameter into the HTTP response. The browser, receiving the payload, executes the script in the context of the vulnerable WordPress site's domain.\nThis allows the attacker to bypass the Same-Origin Policy (SOP) restrictions, enabling the exfiltration of sensitive session cookies, CSRF tokens, or the performance of administrative actions via asynchronous requests initiated by the script.\nIn scenarios where an administrator interacts with the payload, the impact is escalated, potentially leading to full site compromise, such as the creation of unauthorized administrative accounts or the injection of persistent malicious code via the WordPress theme or plugin editors.\nThe vulnerability affects all versions of the Link Library plugin prior to 7.9.6. No authentication is required to trigger the reflection, and the attack is limited only by the ability of the attacker to successfully deliver the malicious link to the target user."
}