CVE-2026-16532: Unknown Link Library

Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days.

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

Affected products

• Unknown Link Library: before 7.9.3 (fixed in 7.9.3)

Published 2026-08-03. Last modified 2026-08-26.