Live › vulnerability › CVE-2026-78392
Go to dashboardThe Link Library WordPress plugin before 7.9.6 does not escape a link field when it is written into an attribute of a link preview. A user with the Contributor role can store a script there, and it runs in the browser of any visitor who opens the preview, even for unpublished submissions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Link Library plugin before where contributors can submit links. The preview is reachable without login, so exposure depends on whether untrusted contributor input reaches the preview page. Sites without this plugin, or with it at or later, can skip it.
7.9.67.9.6No product ranges from the sources yet.
wp plugin get link-library --field=version7.9.6 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication and without checking whether the link has been published, so an unapproved submission is enough to reach any visitor who opens it.
This page as .md · .json · in your agent: get_signal("CVE-2026-78392")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.