CVE-2025-2889

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-2889", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-27T21:19:53.319Z", "datePublished": "2025-04-04T23:22:04.591Z", "dateUpdated": "2026-04-08T16:34:16.644Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:34:16.644Z"}, "affected": [{"vendor": "jackdewey", "product": "Link Library", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "7.7.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Link Additional Parameters in all versions up to, and including, 7.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Link Library <= 7.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Additional Parameters", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0881efbe-9b47-4b56-be2d-12258460b429?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/link-library/tags/7.7.3/link-library-admin.php#L7610"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Siavash Vaez Afshar"}], "timeline": [{"time": "2025-03-20T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-04-04T11:06:08.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-07T16:23:03.819270Z", "id": "CVE-2025-2889", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-07T16:23:11.867Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2889", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-07T16:23:03.819270Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-07T16:23:07.826Z"}}], "cna": {"title": "Link Library <= 7.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Additional Parameters", "credits": [{"lang": "en", "type": "finder", "value": "Siavash Vaez Afshar"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "jackdewey", "product": "Link Library", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.7.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-20T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-04-04T11:06:08.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0881efbe-9b47-4b56-be2d-12258460b429?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/link-library/tags/7.7.3/link-library-admin.php#L7610"}], "descriptions": [{"lang": "en", "value": "The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Link Additional Parameters in all versions up to, and including, 7.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:34:16.644Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2889", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:34:16.644Z", "dateReserved": "2025-03-27T21:19:53.319Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-04-04T23:22:04.591Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Link Library", "vendor": "jackdewey", "versions": [{"lessThanOrEqual": "7.7.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Link Additional Parameters in all versions up to, and including, 7.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Link Library para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s de los par\u00e1metros adicionales del enlace en todas las versiones hasta la 7.7.3 incluida, debido a una depuraci\u00f3n de entrada y al escape de salida insuficiente. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-2889", "lastModified": "2026-06-17T09:07:48.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-2889", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-07T16:23:03.819270Z", "version": "2.0.3"}}]}, "published": "2025-04-05T00:15:15.287", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/link-library/tags/7.7.3/link-library-admin.php#L7610"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0881efbe-9b47-4b56-be2d-12258460b429?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T17:37:44.259214+00:00", "value": {"mitigation_remediation": ["Update the Link Library plugin to a version newer than 7.7.3 if available or discontinue its use.", "If an update is not feasible, revoke Contributor+ privileges from untrusted users or reduce contributor capabilities to read\u2011only access.", "Audit existing links for injected scripts and remove any malicious content; consider enabling a site\u2011wide XSS filter or content\u2011security\u2011policy to block unexpected script execution."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress sites that use the Link Library plugin by jackdewey, all versions up to and including 7.7.3. Any installation where contributors are granted write access to link metadata is susceptible. The risk applies across all environments running these plugin versions, regardless of web server or hosting platform.", "description_and_impact": "The vulnerability arises from insufficient sanitization and escaping of the Link Additional Parameters field in the Link Library plugin. An authenticated user with Contributor or higher access can store malicious JavaScript payloads that are later rendered on pages that display the link. This stored XSS can compromise user sessions, allow phishing, or deface the site, impacting confidentiality, integrity, and availability of affected web pages. The weakness maps to CWE\u201179, an input validation error allowing script injection.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a medium severity. The EPSS score is below 1\u202f%, suggesting that publicly available exploits are unlikely but not impossible. The vulnerability is not listed in CISA\u2019s KEV catalog. Based on the description, the attacker\u2019s entry point is an authenticated account with Contributor privileges, after which the attacker injects malicious code via the link parameters. The stored scripts are executed in the context of any user who views the affected link, enabling client\u2011side compromise."}}}}, "created": "2025-07-12T15:26:07.165291+00:00", "updated": "2026-04-22T17:45:22.922360+00:00", "vendors": ["jackdewey", "jackdewey$PRODUCT$link_library", "wordpress", "wordpress$PRODUCT$wordpress"]}