Is CVE-2026-16535 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-16535

Description

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action.