Stored Cross-Site Scripting Vulnerability in Link Library Plugin by WordPress
CVE-2026-78392
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 22 October 2026
Badges
What is CVE-2026-78392?
The Link Library plugin for WordPress, prior to version 7.9.6, is vulnerable to Stored Cross-Site Scripting (XSS) attacks. This flaw arises from the plugin's failure to properly sanitize and escape a link field when generating a link preview. As a result, users with Contributor roles and higher can exploit this vulnerability, allowing malicious scripts to be executed in the browsers of visitors who access the link preview. Notably, the preview generation occurs without authentication checks and independently of whether the link has been published, making it possible for unauthorized submissions to expose visitors to harmful content.
Affected Version(s)
Link Library 0 < 7.9.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.