The vulnerability arises from the Link Library plugin's failure to sanitize and escape a specific query parameter before reflecting it in the HTTP response. This deficiency allows an unauthenticated attacker to inject malicious JavaScript that is executed in the victim's browser when they load a crafted URL. The impact is reflected XSS, giving an attacker the ability to hijack user sessions, deface content, or redirect users to malicious sites. The weakness matches the classic input validation flaw that underlies CWE‑79.

Any WordPress site that has the Link Library plugin installed with a version earlier than 7.9.4 is vulnerable. The plugin is widely used across sites that rely on it for generating thumbnail rating links. Sites with the vulnerable version that expose the thumbs‑rating like label functionality to visitors can be impacted.

Because the flaw relies on a reflected XSS vector that requires a victim to click a malicious link, the exploitation probability is moderate and can be abused in phishing campaigns or links embedded in seemingly innocuous content. The EPSS score for this CVE is not available, and the vulnerability is not listed in the CISA KEV catalog; however, the lack of a higher‑profile exploitation status does not diminish the risk. The CVSS score is not supplied, but based on typical reflected XSS severity, this issue would rank in the high to critical range. Adversaries could exploit it by luring users through social engineering or by embedding the vulnerable parameter into URLs that appear legitimate.