sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total24
Critical2
High6
Medium16
Reset
Showing 1-20 of 24 records
Threat Entry Updated 2026-09-25

Link Library - Security Vulnerability (CVE-2026-78393)

The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pages, leading to Reflected Cross-Site Scripting which could be used against any visitor, including logged-in administrators.

PLUGIN Link Library

CVE-2026-78393

MEDIUM CVSS 6.1 2026-09-25
Open Full Technical Breakdown
Threat Entry Updated 2026-09-25

Link Library - Security Vulnerability (CVE-2026-78394)

The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including outside the site's document root. The written file name is always numeric with a fixed image extension, so executable code cannot be planted this way.

PLUGIN Link Library

CVE-2026-78394

MEDIUM CVSS 4.1 2026-09-25
Open Full Technical Breakdown
Threat Entry Updated 2026-09-25

Link Library - Security Vulnerability (CVE-2026-78397)

The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn from the response whether an internal service answered. Versions below 7.8.8 are covered by CVE-2025-68600; this entry covers 7.8.8 through 7.9.5, where that fix was incomplete. Exploitation requires the site owner to have published the Link Library WordPress plugin before 7.9.6's public link…

PLUGIN Link Library

CVE-2026-78397

MEDIUM CVSS 4.0 2026-09-25
Open Full Technical Breakdown
Threat Entry Updated 2026-08-20

Link Library - Remote Code Execution (CVE-2026-18855)

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires the administrator to have enabled the 'Delete local file on link deletion' plugin option (disabled by default) and to subsequently permanently delete the attacker-submitted link, which is…

PLUGIN Link Library

CVE-2026-18855

CRITICAL CVSS 9.1 2026-08-15
Open Full Technical Breakdown
Threat Entry Updated 2026-08-26

Link Library - Cross-Site Scripting (XSS) (CVE-2026-16535)

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action.

PLUGIN Link Library

CVE-2026-16535

MEDIUM CVSS 6.1 2026-08-08
Open Full Technical Breakdown
Threat Entry Updated 2026-08-26

Link Library - SQL Injection (CVE-2026-16532)

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

PLUGIN Link Library

CVE-2026-16532

CRITICAL CVSS 9.1 2026-08-03
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Link Library - Cross-Site Scripting (XSS) (CVE-2025-2889)

The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Link Additional Parameters in all versions up to, and including, 7.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Link Library

CVE-2025-2889

MEDIUM CVSS 6.4 2025-04-05
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Link Library - Cross-Site Scripting (XSS) (CVE-2024-13404)

The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'searchll' parameter in all versions up to, and including, 7.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

PLUGIN Link Library

CVE-2024-13404

MEDIUM CVSS 6.1 2025-01-21
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Link Library - Cross-Site Scripting (XSS) (CVE-2024-4281)

The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'link-library' shortcode in all versions up to, and including, 7.6.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Link Library

CVE-2024-4281

MEDIUM CVSS 6.4 2024-05-08
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Link Library - Cross-Site Scripting (XSS) (CVE-2024-2325)

The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the searchll parameter in all versions up to, and including, 7.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

PLUGIN Link Library

CVE-2024-2325

MEDIUM CVSS 6.1 2024-04-09
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Link Library - Cross-Site Scripting (XSS) (CVE-2024-1559)

The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'll_reciprocal' parameter in all versions up to, and including, 7.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Link Library

CVE-2024-1559

MEDIUM CVSS 6.5 2024-02-20
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.