WordPress Plugin Vulnerabilities

Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form

Description

The plugin does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

Proof of Concept

Affects Plugins

Plugin icon
link-library
Fixed in 7.9.3

References

CVE
CVE-2026-16532

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
8.6 (high)

Miscellaneous

Original Researcher
Abdullah Kareem (cyberkareem)
Submitter
Abdullah Kareem (cyberkareem)
Submitter website
https://cyberkareem.com
Verified
Yes
WPVDB ID
da3b8caa-ac99-4097-8286-f3c418ddb63d

Timeline

Publicly Published
2026-07-23 (about 23 hours ago)
Added
2026-07-23 (about 9 hours ago)
Last Updated
2026-07-23 (about 4 minutes ago)

Other

Published
Title
Published
2024-06-19
Title
WP Hotel Booking < 2.1.1 - Unauthenticated SQL Injection
Published
2023-01-23
Title
WP Google Review Slider < 11.8 - Subscriber+ SQLi
Published
2024-09-20
Title
LatePoint < 5.0.12 - Unauthenticated Arbitrary User Password Change via SQL Injection
Published
2015-07-08
Title
Smart Manager for WooCommerce & WPeC <= 3.9.6 - Unauthenticated SQL Injection
Published
2024-04-12
Title
Forms to Zapier, Integromat, IFTTT, Workato, Automate.io, elastic.io, Built.io, APIANT, Webhook <= 1.1.12 - Authenticated (Administrator+) SQL Injection