Medium severity · published Oct 22, 2026
CVE-2026-78392
Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' Parameter
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication and without checking whether the link has been published, so an unapproved submission is enough to reach any visitor who opens it.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LL
Link Library ·
before 7.9.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-78392
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-78392
wpscan.com
https://wpscan.com/vulnerability/35b66d43-c1ce-456b-832b-fb6eda365d93/
More from Link Library
9.1
CVE-2026-16532
Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form
6.1
CVE-2026-78393
Link Library < 7.9.6 - Reflected XSS via 'link_tags' and 'link_price' Sort and Breadcrumb Links
6.1
CVE-2026-16535
Link Library < 7.9.4 - Reflected XSS via Thumbs-Rating likelabel
6.1
CVE-2026-18197
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripting (XSS)
5.3
CVE-2026-78396
Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure