Stored Cross-Site Scripting in Link Library Plugin for WordPress

CVE-2026-116537

What is CVE-2026-116537?

The Link Library plugin for WordPress is afflicted by a Stored Cross-Site Scripting vulnerability that arises from insufficient input sanitization and output escaping via the 'link_description' parameter. All versions up to and including 7.10.0 are impacted. The issue allows unauthenticated attackers to inject arbitrary web scripts into pages, which would execute when a user accesses the affected page. This vulnerability is particularly critical if the site administrator has enabled the non-default 'Convert [] to <> in Link Description and Notes' setting, as this facilitates the injection exploit. If the setting is disabled, the payload remains intact and non-executable.

References