link-library

Link Library through 7.9.4 insufficiently validates the file path consumed by ll_delete_link_fields(). When the non-default 'Delete local file on link deletion' setting is enabled, an unauthenticated attacker can submit a malicious link whose path is later processed when an administrator permanently deletes it during routine moderation. The resulting arbitrary file deletion can lead to site compromise if a critical file such as wp-config.php is removed. The submission field, stored path format, and deletion request are not disclosed.

Link Library before 7.9.4 accepts the likelabel value through its public thumbs_rating_add_vote AJAX action. The action's nonce is available to public visitors, and thumbs_rating_add_vote_callback() passes the value to thumbs_rating_getlink(), which places it into inline onclick JavaScript and HTML without context-appropriate escaping. An unauthenticated attacker can craft a voting request that executes script when a victim is induced to open or submit it, including a logged-in administrator. Version 7.9.4 sanitizes the input and applies JavaScript and HTML escaping at output.

Link Library before 7.9.3 passes an unauthenticated user-supplied value into a SQL query without adequate sanitization or escaping. An unauthenticated attacker can alter the query and extract or modify database data according to the database account's permissions. The CNA record does not disclose the endpoint, parameter, query, vulnerable function or confirmed obtainable fields.

Link Library before 7.9.4 is vulnerable to unauthenticated reflected cross-site scripting through its thumbs_rating_add_vote AJAX handler. An unauthenticated attacker supplies script-bearing input in the likelabel request parameter; the handler reads that value without sanitization and echoes it into an HTML response. If a victim follows the attacker's crafted request, the reflected script executes in the WordPress site's origin and can access information available to that browser session or perform actions as the victim. The Tenable advisory identifies the AJAX handler/action and parameter but does not disclose a separate PHP function name or a more specific URL beyond the WordPress AJAX path. Version 7.9.4 fixes the issue.

Link Library is affected by arbitrary file deletion. Exploitation requires an authenticated contributor account. A successful request can remove files outside the intended scope and may make the site unavailable. The published affected range is n/a through 7.8.8. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Link Library is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Link Library is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Link Library is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Link Library is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Link Library is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Link Library is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Link Library is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Link Library is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Link Library is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Link Library is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Link Library is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Link Library is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Link Library is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Link Library is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Link Library is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

Link Library is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.