CVE-2026-16535: Unknown Link Library

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action.

Affected products

• Unknown Link Library: before 7.9.4 (fixed in 7.9.4)

Published 2026-08-08. Last modified 2026-08-26.