Executive brief
Link Library, a WordPress plugin used to manage and display lists of links and categories, is vulnerable to a security flaw that could allow attackers to execute malicious scripts in a user's browser. By tricking a site visitor or administrator into clicking a specially crafted link, an attacker could potentially steal session information, redirect users to malicious websites, or perform unauthorized actions on the site. This issue is resolved in version 7.9.4.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the Link Library plugin for WordPress before version 7.9.4. The vulnerability is located within the 'thumbs_rating_add_vote' AJAX handler, which processes the 'likelabel' parameter. The plugin fails to sanitize this input before echoing it back into the HTML response. An unauthenticated remote attacker can exploit this by persuading a user to visit a URL containing a malicious payload in the affected parameter. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session. The issue was addressed in version 7.9.4 by implementing proper input sanitization.
Affected products
- Yannick Lefebvre Link Library before 7.9.4
Timeline
- 2026-07-27: disclosed: Security contact request and vendor acknowledgment
- 2026-07-29: patched: Fixed in version 7.9.4
- 2026-07-29: advisory: Tenable and NVD advisory published