CVE-2024-1559 is a stored cross-site scripting vulnerability in the Link Library WordPress plugin (versions up to 7.6) caused by improper neutralization of input in the 'll_reciprocal' parameter. This allows unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the injected pages. The vulnerability is classified under CWE-79 and has a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). No patch or official remediation details are currently available.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the browsers of users who visit the affected pages, potentially leading to limited confidentiality and integrity impacts such as session hijacking or content manipulation. There is no impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the Link Library plugin or restricting access to affected pages to trusted users only. Implementing web application firewall (WAF) rules to detect and block malicious input targeting the 'll_reciprocal' parameter may provide temporary mitigation.