The vulnerability resides in the WordPress Link Library plugin in versions up to 7.8 and allows an attacker to inject malicious script code that is stored in a database entry. When a legitimate user views the affected page, the script executes in their browser. This can lead to theft of session cookies, defacement of the site, or redirection to malicious resources. The weakness is a classic input‑validation failure classified as CWE‑79.

The affected product is the Link Library plugin created by Yannick Lefebvre. Versions from an unspecified lower bound up to 7.8 are susceptible. The vulnerability is not limited to a specific sub‑module; any user interface that accepts link or item input is potentially exploitable.

The CVSS score of 6.5 indicates a medium to high severity, while the EPSS score of less than 1% suggests exploitation is unlikely at this time. The vulnerability is not included in CISA’s KEV catalog. However, because the attack surface is the web interface, a remote attacker could forge a crafted request to store malicious code if the CMS owner is unaware of the flaw. If an attacker gains administrative access, the impact multiplies as the entire site can be compromised.