CVE-2024-2325

CVE-2024-2325 concerns the WordPress Link Library plugin. Affected versions up to and including 7.6.6 are vulnerable to a Reflected Cross‑Site Scripting (XSS) flaw via the searchll parameter, caused by insufficient input sanitization and output escaping. This can enable unauthenticated attackers ...

CVE-2024-24875

CVE-2024-24875 is a CSRF vulnerability in the WordPress Link Library plugin by Yannick Lefebvre, affecting Link Library versions through 7.5.13. The issue allows an attacker to perform unintended actions on behalf of an authenticated user (CSRF). The available connected documents indicate a fix i...

CVE-2022-4199

CVE-2022-4199 affects the Link Library WordPress plugin (versions prior to 7.4.1). Root cause: the plugin does not sanitise and escape some settings, enabling stored XSS by high-privilege users (e.g., admins), even when unfiltered_html is disallowed (e.g., multisite). Impact: storedCross‑SiteScri...

CVE-2024-1559

CVE-2024-1559 : The Link Library WordPress plugin is vulnerable to unauthenticated Stored XSS via the ‘ll_reciprocal’ parameter in all versions up to 7.6. Root cause: insufficient input sanitization and output escaping. Impact: attackers can inject arbitrary scripts that run when users view injec...

CVE-2024-29123

CVE-2024-29123: Reflected XSS in Yannick Lefebvre Link Library (WordPress plugin) due to improper input neutralization during page generation. Affected: Link Library plugin for WordPress, versions up to 7.6. Outcome per sources: the vulnerability exists and has a patch available; risk details and...

CVE-2024-4281

CVE-2024-4281 affects the WordPress Link Library plugin (vulnerable up to 7.6.11) via the link-library shortcode. The issue is stored XSS caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requiresContributor+ access (authenticated). Impact is ...

CVE-2024-35687

CVE-2024-35687 is a Reflected XSS in the WordPress plugin Link Library (link-library) affecting versions up to 7.6.3. The issue arises from improper input neutralization during web page generation, enabling attackers to inject scripts via crafted input. Reliably, patches have been released; remed...

CVE-2024-13404

CVE-2024-13404 concerns the WordPress Link Library plugin. Affected: Link Library (WordPress) up to version 7.7.2. Issue: Reflected Cross-Site Scripting via the searchll parameter caused by insufficient input sanitization and output escaping. Impact: unauthenticated attackers could inject web scr...

CVE-2025-46237

CVE-2025-46237 affects the WordPress plugin Link Library (versions up to and including 7.8). It enables a Stored XSS via improper input neutralization during web page generation. A patched/fixed release is available (per patch-status), but the exact patched version is not specified here; remediat...

CVE-2021-25091

CVE-2021-25091 affects the WordPress Link Library plugin prior to 7.2.9. The vulnerability is a Reflected Cross-Site Scripting (XSS) caused by insufficient sanitisation/escaping of the settingscopy parameter before it is output on an admin page. Impact is reflected XSS as described in multiple so...

CVE-2024-38711

CVE-2024-38711 is a reflected XSS in WordPress Link Library plugin. The issue arises from improper input neutralization during web page generation, allowing cross-site scripting. Affected versions are Link Library: from n/a through 7.7.1. CVSS metrics from NVD show MEDIUM risk (6.1 base, AV:N/AC:...

CVE-2021-25092

CVE-2021-25092 affects WordPress Link Library plugin versions prior to 7.2.8. The root cause is the absence of a CSRF check when resetting library settings, enabling a logged-in attacker to trigger a reset of arbitrary settings via CSRF. The practical impact is admin-level configuration changes w...

CVE-2021-25093

The CVE concerns the WordPress Link Library plugin prior to version 7.2.8, where missing authorization for link deletion allows unauthenticated users to remove arbitrary links. The underlying issue is an authority check gap when performing delete requests, enabling exploitation without credential...

CVE-2024-24879

CVE-2024-24879 refers to a Cross-Site Scripting (XSS) flaw in the WordPress Link Library plugin, affecting versions