CVE-2026-78392: Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' Parameter
The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication and without checking whether the link has been published, so an unapproved submission is enough to reach any visitor who opens it.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with the WordPress Contributor role or any higher-privileged role can submit a malicious value in the affected link field. The attacker does not need publishing approval for the preview to be reachable.
Are unauthenticated visitors at risk?
Yes. The link preview is generated without authentication, so any visitor who opens a preview containing the malicious submission can trigger the stored script.
Does an administrator need to publish the submitted link before it can be exploited?
No. The preview does not check whether the link has been published, so an unapproved Contributor submission is sufficient.