CVE WATCH / VULNERABILITY DETAIL
CVE-2026-78392
MEDIUMCVSS 6.8NVD feed
Published 22 October 2026 · tracked since 23 October 2026
Description
The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication and
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog