Security Alert Summary
The Link Library WordPress plugin contains a stored cross-site scripting (XSS) vulnerability that allows users with the Contributor role and above to submit a crafted link which is output into a link preview without proper sanitisation or escaping. The preview is generated without authentication and without checking whether the link has been published, so an unapproved submission can reach any visitor who opens the preview.
CVE Details
- CVE ID: CVE-2026-78392
- Affected component: The Link Library WordPress plugin
- Affected versions: Versions before 7.9.6
- Published: October 22, 2026 at 06:17:15 AM UTC
- Last modified: October 22, 2026 at 03:16:14 PM UTC
- CVSS v3.1 base score: 6.8
- CVSS v3.1 severity: MEDIUM
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H - Authentication / privileges / user interaction:
- From CVSS data: Privileges Required = HIGH; User Interaction = REQUIRED; Attack Vector = NETWORK
- From the vulnerability description: an attacker needs the ability to submit a link (Contributor role and above) and the preview is generated without authentication, so an unapproved submission can reach site visitors.
- Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation, a cross-site scripting issue)
Technical Details
The plugin does not sanitise and escape a link field before outputting it inside an attribute of a link preview. Because the link field is embedded directly into the preview output, a malicious contributor can include payloads that result in stored cross-site scripting when the preview is rendered in a visitor’s browser.
The preview is generated without authentication and without verifying that the submitted link has been published. That means a crafted, unapproved submission can be included in a preview seen by any visitor who opens it. The description does not name specific functions or REST endpoints involved.
Impact is limited to what XSS in the preview can achieve in a visitor’s browser: execution of injected script in the context of the site, which can lead to disclosure of data accessible by the page, modification of displayed content, or actions that the visitor’s browser is permitted to perform. The CVSS metrics indicate high impact to confidentiality, integrity, and availability, and require user interaction for the exploit to be effective.
How This Could Impact Your Website
Consider a small site with an owner, internal staff (editors), and external contributors. An external contributor submits a link containing a crafted XSS payload. Because the preview is generated without authentication and without checking publish status, a staff member or public visitor who views the preview could have malicious script executed in their browser.
Practical consequences include exposure of information visible to the page (for example, data that a logged-in user can see), manipulation of page content in visitors’ browsers, and an increased risk of targeted phishing or social engineering against staff whose browser context is affected. If internal email addresses or other contact details are visible on pages where the preview appears, those could be collected by an attacker.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Contributor and higher roles for untrusted accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior, particularly submissions that include unexpected markup in link fields.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
