The Link Library plugin for WordPress, developed by jackdewey, is vulnerable to reflected cross-site scripting via the searchll parameter due to inadequate input sanitization and output escaping. This vulnerability affects all versions up to and including 7.6.6. An unauthenticated attacker can craft a URL containing malicious script code in the searchll parameter that executes in the context of the victim's browser if the victim clicks the link. The vulnerability is tracked as CVE-2024-2325 with a CVSS 3.1 base score of 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and impact on confidentiality and integrity but not availability. No patch or official remediation guidance is currently provided by the vendor. The vulnerability is not related to any cloud service and no known exploits have been reported.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of a victim's browser when the victim interacts with a maliciously crafted link. This can lead to partial compromise of confidentiality and integrity of user data within the affected site. There is no impact on availability. The attack requires user interaction, limiting the scope of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should exercise caution when clicking on links involving the Link Library plugin and consider disabling or removing the plugin if feasible. Monitoring official jackdewey or WordPress plugin update channels for a security update is recommended.