The vulnerability arises from insufficient sanitization and escaping of the Link Additional Parameters field in the Link Library plugin. An authenticated user with Contributor or higher access can store malicious JavaScript payloads that are later rendered on pages that display the link. This stored XSS can compromise user sessions, allow phishing, or deface the site, impacting confidentiality, integrity, and availability of affected web pages. The weakness maps to CWE‑79, an input validation error allowing script injection.

WordPress sites that use the Link Library plugin by jackdewey, all versions up to and including 7.7.3. Any installation where contributors are granted write access to link metadata is susceptible. The risk applies across all environments running these plugin versions, regardless of web server or hosting platform.

The CVSS score of 6.4 indicates a medium severity. The EPSS score is below 1 %, suggesting that publicly available exploits are unlikely but not impossible. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attacker’s entry point is an authenticated account with Contributor privileges, after which the attacker injects malicious code via the link parameters. The stored scripts are executed in the context of any user who views the affected link, enabling client‑side compromise.