Description
The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication and without checking whether the link has been published, so an unapproved submission is enough to reach any visitor who opens it.
Published:
2026-10-22
Score:
n/a
EPSS:
n/a
KEV:
No
Impact:
n/a
Action:
n/a
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | Link Library | unaffected |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
History
Thu, 22 Oct 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication and without checking whether the link has been published, so an unapproved submission is enough to reach any visitor who opens it. | |
| Title | Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' Parameter | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-10-22T06:00:18.482Z
Reserved: 2026-08-24T14:15:50.528Z
Link: CVE-2026-78392
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-22T06:17:15.303
Modified: 2026-10-22T06:17:15.303
Link: CVE-2026-78392
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.