The vulnerability is a stored cross‑site scripting flaw in the Link Library WordPress plugin, allowing an attacker to inject arbitrary web scripts via the link_description parameter. Insufficient input sanitization and output escaping cause the injected payload to execute in any user's browser when they view a page containing the compromised link. The flaw can be triggered only when the site administrator has enabled the non‑default Convert [] to <> in Link Description and Notes setting, which converts brackets to angle brackets.

All instances of the Link Library plugin from the initial release up to and including version 7.10.0 are affected. The vulnerability manifests only when the site administrator has enabled the non‑default setting that converts square brackets to angle brackets (use_html_tags). If this option remains disabled, the payload is never reconstructed into executable HTML and the flaw does not trigger.

The CVSS score of 7.2 indicates a high severity with a high likelihood of exploitation. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can inject a malicious script by interacting with the user‑submission or administrative interfaces that allow submission of link descriptions, and no authentication is required. This creates a persistent threat that can be triggered with each visit to the affected page.