Executive brief
The myLinksDump plugin for WordPress, which is used to manage and display link collections, contains a security flaw that allows high-level users to plant malicious scripts. In specific environments like multi-site networks, an administrator could use this to execute unauthorized code when other users visit certain pages. This could lead to unauthorized actions being performed in the context of other users' sessions.
Technical details
The myLinksDump plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'link_title' parameter in versions up to and including 1.6. The vulnerability stems from insufficient input sanitization and output escaping of user-supplied data. An authenticated attacker with administrator-level privileges can inject arbitrary web scripts into pages. This exploit is primarily relevant in WordPress multi-site installations or environments where the 'unfiltered_html' capability has been disabled for administrators. When a user accesses the affected page, the injected script executes within their browser session.
Affected products
- WordPress myLinksDump Up to and including 1.6
Timeline
- 2026-05-27: advisory
References
- https://plugins.trac.wordpress.org/browser/mylinksdump/tags/1.6/myLinksDump.php
- https://plugins.trac.wordpress.org/browser/mylinksdump/tags/1.6/myLinksDump.php
- https://plugins.trac.wordpress.org/browser/mylinksdump/trunk/myLinksDump.php
- https://plugins.trac.wordpress.org/browser/mylinksdump/trunk/myLinksDump.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/efd18739-3cd1-486c-9587-8deba5a0940e?source=cve