CVE-2026-78392

MediumCVSS 6.8/10Last modified Oct 22, 2026

Description

The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication and without checking whether the link has been published, so an unapproved submission is enough to reach any visitor who opens it.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownLink Library< 7.9.6

References

Timeline

Published
Oct 22, 2026
Last modified
Oct 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-783936.1The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it CVE-2026-783944.1The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to diskCVE-2026-783955.3The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-endCVE-2026-783965.3The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is CVE-2026-783974.0The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotecteCVE-2026-783996.5IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an authenticated user to cauCVE-2026-78409.8UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The functions wi_senderr() aCVE-2026-784019.8IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attCVE-2026-784027.8Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers.  SenCVE-2026-784039.8Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. SentiCVE-2026-784046.5IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility.CVE-2026-784069.8IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated att
CVE-2026-78392: Medium severity, CVSS 6.8 | Vulnix