Unknown Link Library vulnerabilities

5 CVEs affecting Unknown Link Library, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-78397, published 2026-09-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-16532, published 2026-08-03. Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days. The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection…
CVE-2026-16535, published 2026-08-08. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site…
CVE-2026-78394, published 2026-09-25. Medium severity, CVSS 4.1. EPSS: 0.2% chance of exploitation in the next 30 days. The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to…
CVE-2026-78397, published 2026-09-25. Medium severity, CVSS 4.0. EPSS: 0.2% chance of exploitation in the next 30 days. The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing…
CVE-2026-78393, published 2026-09-25. Medium severity, CVSS 6.1. EPSS: 0.1% chance of exploitation in the next 30 days. The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pages, leading to…