CVE-2026-78392

Deferred Deferred - Pending Action

Stored Cross-Site Scripting in Link Library WordPress Plugin

Publication date: 2026-10-22

Last updated on: 2026-10-22

Assigner: WPScan

Description

The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication and without checking whether the link has been published, so an unapproved submission is enough to reach any visitor who opens it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-22

Last Modified

2026-10-22

Generated

2026-10-23

AI Q&A

2026-10-23

EPSS Evaluated

N/A

NVD

CVE-2026-78392

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Link Library	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Link Library WordPress plugin before version 7.9.6. The plugin fails to properly sanitize and escape user-provided link data before displaying it in a link preview. Attackers with Contributor role or higher can inject malicious scripts into the link field. These scripts are stored on the server and executed when any visitor views the affected preview, even without authentication or published status.

Detection Guidance

Check for the Link Library WordPress plugin version before 7.9.6. Inspect WordPress admin pages for untrusted script execution in link previews. Monitor network traffic for unexpected script injections in link attributes.

Impact Analysis

An attacker could steal sensitive user data like cookies or session tokens, redirect visitors to malicious websites, or perform actions on behalf of users. Since the preview loads without authentication, all visitors are potential targets. The impact depends on the website's traffic and the attacker's goals, ranging from defacement to full account compromise.

Compliance Impact

This vulnerability could lead to violations of GDPR (data protection) and HIPAA (health data privacy) by exposing user data through XSS attacks. If personal data is compromised, organizations may face regulatory fines, legal liabilities, and reputational damage. Compliance requires proper data protection measures, which this vulnerability undermines.

Mitigation Strategies

Update the Link Library plugin to version 7.9.6 or later. Remove or disable the plugin if not needed. Review and remove any suspicious link submissions in WordPress.

Hi! I’m here to help you understand CVE-2026-78392. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70