The Link Library WordPress plugin prior to version 7.9.6 fails to properly escape some parameters before outputting them in the URLs of links generated on its front-end directory pages. This improper sanitization leads to a Reflected Cross-Site Scripting (CWE-79) vulnerability, which can be exploited by attackers to inject and execute arbitrary scripts in the browsers of users visiting affected pages. The vulnerability affects all versions from 0 up to but not including 7.9.6.

Successful exploitation of this vulnerability could allow attackers to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to theft of sensitive information, session hijacking, or actions performed on behalf of the victim, including administrators. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability.

A fix is available in Link Library version 7.9.6. Users should update to version 7.9.6 or later to remediate this vulnerability. No additional mitigation steps are indicated in the advisory.