CVE-2026-78395: medium-severity vulnerability in Link Library
Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.2%
The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another library that does not.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · Link Librarypublic PoCs found — 1
cve_referencewpscan.com/vulnerability/e2cf7d5f-b9c9-4320-9fc8-4ac8c6d24f78/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Link Library
In the same product, most dangerous first.
CVE-2021-25093—Link Library < 7.2.8 - Unauthenticated Arbitrary Links DeletionEPSS 1.2%CVE-2021-25091—Link Library < 7.2.9 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2026-16535MEDIUMLink Library < 7.9.4 - Reflected XSS via Thumbs-Rating likelabelEPSS 0.5%CVE-2021-25092—Link Library < 7.2.8 - Library Settings Reset via CSRFEPSS 0.5%CVE-2022-4199MEDIUMLink Library < 7.4.1 - Admin+ Stored XSSEPSS 0.5%CVE-2026-16532CRITICALLink Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission FormEPSS 0.5%