Medium severity · published Oct 29, 2026
CVE-2026-78395
Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass
New
5.3
CVSS
–
EPSS
No
On KEV
Description
The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another library that does not.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LL
Link Library ·
before 7.10.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-78395
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-78395
exploit
https://wpscan.com/vulnerability/e2cf7d5f-b9c9-4320-9fc8-4ac8c6d24f78/
More from Link Library
9.1
CVE-2026-16532
Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form
6.8
CVE-2026-78392
Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' Parameter
6.1
CVE-2026-78393
Link Library < 7.9.6 - Reflected XSS via 'link_tags' and 'link_price' Sort and Breadcrumb Links
6.1
CVE-2026-16535
Link Library < 7.9.4 - Reflected XSS via Thumbs-Rating likelabel
6.1
CVE-2026-18197
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripting (XSS)