Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?Link LibraryResource Library for Logged In Users
Plugin · link-library
Link Library
26 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 22, 2026Link Library: Does not sanitise and escape a link field before outputting it inside an attribute of a link previewCVE-2026-78392 · fixed in 7.9.6 · reported by WPScanMedium 6.8
The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication and without checking whether the link has been published, so an unapproved submission is enough to reach any visitor who opens it.
Oct 15, 2026Link Library: Time-based SQL InjectionCVE-2026-15090 · affects up to 7.9.2 · reported by WordfenceHigh 7.5
The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 25, 2026Link Library: Does not validate the destination of a user-supplied URL before falling back to an unprotected fetchCVE-2026-78397 · affects up to 7.9.5 · fixed in 7.9.6 · reported by WPScanMedium 4
The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn from the response whether an internal service answered. Versions below 7.8.8 are covered by CVE-2025-68600; this entry covers 7.8.8 through 7.9.5, where that fix was incomplete. Exploitation requires the site owner to have published the Link Library WordPress plugin before 7.9.6's public link submission form with reciprocal-link validation enabled.
Sep 25, 2026Link Library: Does not sanitize a user-supplied destination folder before writing a generated image to diskCVE-2026-78394 · fixed in 7.9.6 · reported by WPScanMedium 4.1
The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including outside the site's document root. The written file name is always numeric with a fixed image extension, so executable code cannot be planted this way.
Sep 25, 2026Link Library: Does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pagesCVE-2026-78393 · fixed in 7.9.6 · reported by WPScanMedium 6.1
The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pages, leading to Reflected Cross-Site Scripting which could be used against any visitor, including logged-in administrators.
Aug 15, 2026Link Library: Arbitrary file deletionCVE-2026-18855 · affects up to 7.9.4 · reported by WordfenceCritical 9.1
The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires the administrator to have enabled the 'Delete local file on link deletion' plugin option (disabled by default) and to subsequently permanently delete the attacker-submitted link, which is a routine moderation action.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 8, 2026Link Library: Does not sanitise and escape a parameter before reflecting it back in a responseCVE-2026-16535 · fixed in 7.9.4 · reported by WPScanMedium 6.1
The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action.
Aug 3, 2026Link Library: Does not properly sanitise and escape a user-supplied value before using it in a SQL queryCVE-2026-16532 · fixed in 7.9.3 · reported by WPScanCritical 9.1
The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Jul 29, 2026Link Library: Improper neutralization of input during web page generation ('cross-site scripting')CVE-2026-18197 · fixed in 7.9.4 · reported by vulnreport@tenable.comMedium 6.4
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripting (XSS). This issue affects Link Library: before 7.9.4.
Jun 15, 2026Contributor Arbitrary File Deletion in Link Library <= 7.8.8 versions.CVE-2026-40779 · affects up to 7.8.8 · reported by PatchstackHigh 7.7
Contributor Arbitrary File Deletion in Link Library <= 7.8.8 versions.
Dec 24, 2025Link Library: Server-Side Request Forgery (SSRF)CVE-2025-68600 · affects up to 7.8.7 · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Yannick Lefebvre Link Library link-library allows Server Side Request Forgery.This issue affects Link Library: from n/a through <= 7.8.7.
Apr 22, 2025Link Library: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46237 · affects up to 7.8 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library link-library allows Stored XSS.This issue affects Link Library: from n/a through <= 7.8.
Apr 4, 2025Link Library: Stored Cross-Site ScriptingCVE-2025-2889 · affects up to 7.7.3 · reported by WordfenceMedium 6.4
The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Link Additional Parameters in all versions up to, and including, 7.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Jan 21, 2025Link Library: Reflected Cross-Site ScriptingCVE-2024-13404 · affects up to 7.7.2 · reported by WordfenceMedium 6.1
The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'searchll' parameter in all versions up to, and including, 7.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Jul 20, 2024Link Library: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38711 · affects up to 7.7.1 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library allows Reflected XSS.This issue affects Link Library: from n/a through 7.7.1.
Jun 8, 2024Link Library: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35687 · affects up to 7.6.3 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library link-library allows Reflected XSS.This issue affects Link Library: from n/a through 7.6.3.
May 8, 2024Link Library: Stored Cross-Site ScriptingCVE-2024-4281 · affects up to 7.6.11 · reported by WordfenceMedium 6.4
The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'link-library' shortcode in all versions up to, and including, 7.6.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Apr 9, 2024Link Library: Reflected Cross-Site ScriptingCVE-2024-2325 · affects up to 7.6.6 · reported by WordfenceMedium 6.1
The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the searchll parameter in all versions up to, and including, 7.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Mar 19, 2024Link Library: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29123 · affects up to 7.6 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library allows Reflected XSS.This issue affects Link Library: from n/a through 7.6.
Feb 19, 2024Link Library: Stored Cross-Site ScriptingCVE-2024-1559 · affects up to 7.6 · reported by WordfenceMedium 6.5
The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'll_reciprocal' parameter in all versions up to, and including, 7.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Feb 12, 2024Link Library: Cross-Site Request Forgery (CSRF)CVE-2024-24875 · affects up to 7.5.13 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Yannick Lefebvre Link Library.This issue affects Link Library: from n/a through 7.5.13.
Feb 8, 2024Link Library: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24879 · affects up to 7.5.13 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library allows Reflected XSS.This issue affects Link Library: from n/a through 7.5.13.
Jan 16, 2023Link Library: Does not sanitise and escape some of its settingsCVE-2022-4199 · fixed in 7.4.1 · reported by WPScanMedium 4.8
The Link Library WordPress plugin before 7.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Feb 1, 2022Link Library: Does not have authorisation in placeCVE-2021-25093 · fixed in 7.2.8 · reported by WPScanHigh 7.5
The Link Library WordPress plugin before 7.2.8 does not have authorisation in place when deleting links, allowing unauthenticated users to delete arbitrary links via a crafted request
Feb 1, 2022Link Library: Does not have CSRF checkCVE-2021-25092 · fixed in 7.2.8 · reported by WPScanMedium 6.5
The Link Library WordPress plugin before 7.2.8 does not have CSRF check when resetting library settings, allowing attackers to make a logged in admin reset arbitrary settings via a CSRF attack
Feb 1, 2022Link Library: Does not sanitise and escape the settingscopy parameter before outputting it back in an admin pageCVE-2021-25091 · fixed in 7.2.9 · reported by WPScanMedium 6.1
The Link Library WordPress plugin before 7.2.9 does not sanitise and escape the settingscopy parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.