Medium severity · published Sep 25, 2026
CVE-2026-78393
Link Library < 7.9.6 - Reflected XSS via 'link_tags' and 'link_price' Sort and Breadcrumb Links
6.1
CVSS
0.1%
EPSS
No
On KEV
Description
The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pages, leading to Reflected Cross-Site Scripting which could be used against any visitor, including logged-in administrators.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LL
Link Library ·
before 7.9.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-78393
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-78393
wpscan.com
https://wpscan.com/vulnerability/2605888a-195d-4bce-8aac-347710ad1de8/
More from Link Library
9.1
CVE-2026-16532
Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form
6.8
CVE-2026-78392
Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' Parameter
6.1
CVE-2026-16535
Link Library < 7.9.4 - Reflected XSS via Thumbs-Rating likelabel
6.1
CVE-2026-18197
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripting (XSS)
4.1
CVE-2026-78394
Link Library < 7.9.6 - Contributor+ Path Traversal via 'filepath' Parameter