CVE-2026-78397mediumCWE-918

CVE-2026-78397: fallo de gravedad media en Link Library

Link Library < 7.9.6 - Unauthenticated SSRF via Reciprocal Link Validation

Publicada el

Seguir esta CVE+ Monitorear Link Library

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 4epss 0.2%
The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn from the response whether an internal service answered. Versions below 7.8.8 are covered by CVE-2025-68600; this entry covers 7.8.8 through 7.9.5, where that fix was incomplete. Exploitation requires the site owner to have published the Link Library WordPress plugin before 7.9.6's public link submission form with reciprocal-link validation enabled.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Productos afectados
Unknown · Link Library
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Link Library

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-25093—Link Library < 7.2.8 - Unauthenticated Arbitrary Links DeletionEPSS 1.2%CVE-2021-25091—Link Library < 7.2.9 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2026-16535MEDIUMLink Library < 7.9.4 - Reflected XSS via Thumbs-Rating likelabelEPSS 0.5%CVE-2021-25092—Link Library < 7.2.8 - Library Settings Reset via CSRFEPSS 0.5%CVE-2022-4199MEDIUMLink Library < 7.4.1 - Admin+ Stored XSSEPSS 0.5%CVE-2026-16532CRITICALLink Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission FormEPSS 0.5%