The vulnerability arises from the Link Library plugin's failure to sanitize and escape a specific query parameter before reflecting it in the HTTP response. This deficiency allows an unauthenticated attacker to inject malicious JavaScript that is executed in the victim's browser when they load a crafted URL. The impact is reflected XSS, giving an attacker the ability to hijack user sessions, deface content, or redirect users to malicious sites. The weakness matches the classic input validation flaw that underlies CWE‑79.

Any WordPress site that has the Link Library plugin installed with a version earlier than 7.9.4 is vulnerable. The plugin is widely used across sites that rely on it for generating thumbnail rating links. Sites with the vulnerable version that expose the thumbs‑rating like label functionality to visitors can be impacted.

Because the flaw relies on a reflected XSS vector that requires a victim to click a malicious link, the exploitation probability is low and can be abused in phishing campaigns or links embedded in seemingly innocuous content. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog; however, the lack of a higher‑profile exploitation status does not diminish the risk. The CVSS score is 6.1, indicating a medium‑severity reflected XSS vulnerability that can be abused in social engineering or by embedding the vulnerable parameter into URLs that appear legitimate.