The Link Library WordPress plugin fails to sanitize or escape the value of a URL field before embedding it inside an attribute of an HTML link preview. Users with the Contributor role or higher can submit arbitrary content that will be stored and later rendered to any visitor audience. This stored cross‑site scripting flaw permits the injection of malicious JavaScript which will run whenever a site visitor views the preview, potentially compromising user credentials.

Any WordPress installation running the Link Library plugin of a version earlier than 7.9.6 is affected. The vulnerability manifests only when the plugin is enabled and a link preview is generated; all visitors to the site, regardless of authentication, can be exposed.

The vulnerability does not require privileged access beyond Contributor+, an authority that is commonly assigned to content authors. Because the preview is generated without authentication or approval checks, a single malicious submission is sufficient for widespread exposure. The CVSS score is 6.8, indicating a high severity, and the exploit probability is not listed in EPSS. The flaw is not part of the CISA KEV catalog. Attackers can exploit this by creating or editing a link using a Contributor account and awaiting unauthenticated visitors to trigger the malicious payload, giving a high potential for cross‑site compromise. The risk is moderate to high, especially on sites with an open contributor base.