The Link Library plugin for WordPress suffers from a reflected cross-site scripting vulnerability (CWE-79) via the 'searchll' parameter. This occurs due to improper neutralization of input during web page generation, allowing injection of malicious scripts that execute when a user interacts with a crafted link. The vulnerability is unauthenticated and affects all versions up to 7.7.2. The CVSS 3.1 base score is 6.1 (medium), with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity but no impact on availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to information disclosure or manipulation of user interactions within affected web pages. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires user interaction and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Link Library plugin or applying manual input sanitization workarounds if feasible. Additionally, users should exercise caution when clicking on untrusted links that may exploit this vulnerability.