Is CVE-2026-18197 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18197 being exploited in the wild.

How severe is CVE-2026-18197?

Informational severity, with a CVSS score of 6.4, published 29 July 2026.

Which products and versions are affected?

Yannick Lefebvre Link Library before 7.9.4.

Is there a fix for CVE-2026-18197?

A patch was published on 2026-07-29: Fixed in version 7.9.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-18197 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-18197?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18197: Yannick Lefebvre Link Library reflected XSS in thumbs_rating_add_vote

CVE-2026-18197 · Severity: info · CVSS 6.4 · Published 2026-07-29

Link Library, a WordPress plugin used to manage and display lists of links and categories, is vulnerable to a security flaw that could allow attackers to execute malicious scripts in a user's browser. By tricking a site visitor or administrator into clicking a specially crafted link, an attacker could potentially steal session information, redirect users to malicious websites, or perform unauthorized actions on the site. This issue is resolved in version 7.9.4.

Quick answers

Is CVE-2026-18197 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18197 being exploited in the wild.
How severe is CVE-2026-18197?: Informational severity, with a CVSS score of 6.4, published 29 July 2026.
Which products and versions are affected?: Yannick Lefebvre Link Library before 7.9.4.
Is there a fix for CVE-2026-18197?: A patch was published on 2026-07-29: Fixed in version 7.9.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-18197 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-18197?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the Link Library plugin for WordPress before version 7.9.4. The vulnerability is located within the 'thumbs_rating_add_vote' AJAX handler, which processes the 'likelabel' parameter. The plugin fails to sanitize this input before echoing it back into the HTML response. An unauthenticated remote attacker can exploit this by persuading a user to visit a URL containing a malicious payload in the affected parameter. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session. The issue was addressed in version 7.9.4 by implementing proper input sanitization.

Affected products

Yannick Lefebvre Link Library before 7.9.4

Timeline

2026-07-27: disclosed: Security contact request and vendor acknowledgment
2026-07-29: patched: Fixed in version 7.9.4
2026-07-29: advisory: Tenable and NVD advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.