PT-2026-98358

Name of the Vulnerable Software and Affected Versions Link Library versions prior to 7.9.6 Description Insufficient escaping of parameters used in the addresses of links generated on front-end directory pages allows Reflected Cross-Site Scripting XSS. This occurs via the link tags and link price...

PT-2026-98359

Name of the Vulnerable Software and Affected Versions Link Library versions prior to 7.9.6 Description Insufficient sanitization of a user-supplied destination folder occurs when writing a generated image to disk. This allows users with the Contributor role and above to create directories and wri...

CVE-2026-78393: Improper Neutralization of Input During Web Page Generation

The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pages, leading to Reflected Cross-Site Scripting which could be used against any visitor, including logged-in...

PT-2026-98360

The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn fr...

WordPress Link Library plugin < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form vulnerability

Unauthenticated SQL Injection via the Front-End Link Submission Form vulnerability discovered by Abdullah Kareem cyberkareem in WordPress Plugin Link Library versions 7.9.3...

WordPress Link Library plugin <= 7.9.4 - Unauthenticated Arbitrary File Deletion via link_url Parameter vulnerability

Unauthenticated Arbitrary File Deletion via linkurl Parameter vulnerability discovered by nudien in WordPress Plugin Link Library versions = 7.9.4...

CVE-2026-18855

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the lldeletelinkfields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, whic...

CVE-2026-18855

The CVE refers to the WordPress Link Library plugin (versions up to 7.9.4) with a vulnerability in the ll_delete_link_fields/ll delete link fields function that allows unauthenticated arbitrary file deletion due to insufficient file path validation. This can lead to remote code execution if a cri...

CVE-2026-18855 Link Library <= 7.9.4 - Unauthenticated Arbitrary File Deletion via link_url Parameter

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the lldeletelinkfields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, whic...

EUVD-2026-59784

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the lldeletelinkfields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, whic...

CVE-2026-18855

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the lldeletelinkfields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, whic...

CVE-2026-18855 Link Library <= 7.9.4 - Unauthenticated Arbitrary File Deletion via link_url Parameter

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the lldeletelinkfields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, whic...

PT-2026-73045

Name of the Vulnerable Software and Affected Versions Link Library versions prior to 7.9.5 Description Insufficient file path validation in the ll delete link fields function allows unauthenticated attackers to delete arbitrary files on the server. This can lead to remote code execution if critic...

CVE-2026-18855: Improper Limitation of a Pathname to a Restricted Directory

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the lldeletelinkfields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, whic...

CVE-2026-13133

LineInst.exe (LINE for Windows) before version 26.4.0 is vulnerable because Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer directory to be loaded ahead of the legitimate System32 copy. The CVSS metrics indicate a HIGH ...

CVE-2026-13133

A vulnerability has been identified in LineInst.exe LINE for Windows prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy...

CVE-2026-16535

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action...

CVE-2026-16535 Link Library < 7.9.4 - Reflected XSS via Thumbs-Rating likelabel

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action...

CVE-2026-16535

The Link Library WordPress plugin version before 7.9.4 is vulnerable to a Reflected Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape a parameter before reflecting it back in an HTTP response. This allows unauthenticated attackers to target users who...

EUVD-2026-54732

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action...