Threat Database

Threat Entry Updated 2026-06-17

Link Library - Cross-Site Scripting (XSS) (CVE-2022-4199)

The Link Library WordPress plugin before 7.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

PLUGIN Link Library

CVE-2022-4199

MEDIUM CVSS 4.8 2023-01-16

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Link Library - Security Vulnerability (CVE-2021-25093)

The Link Library WordPress plugin before 7.2.8 does not have authorisation in place when deleting links, allowing unauthenticated users to delete arbitrary links via a crafted request

PLUGIN Link Library

CVE-2021-25093

HIGH CVSS 7.5 2022-02-01

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Link Library - Cross-Site Request Forgery (CSRF) (CVE-2021-25092)

The Link Library WordPress plugin before 7.2.8 does not have CSRF check when resetting library settings, allowing attackers to make a logged in admin reset arbitrary settings via a CSRF attack

PLUGIN Link Library

CVE-2021-25092

MEDIUM CVSS 6.5 2022-02-01

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Link Library - Cross-Site Scripting (XSS) (CVE-2021-25091)

The Link Library WordPress plugin before 7.2.9 does not sanitise and escape the settingscopy parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

PLUGIN Link Library

CVE-2021-25091

MEDIUM CVSS 6.1 2022-02-01

Risk Score

Open Full Technical Breakdown