CVE-2024-13404: Link Library WordPress Plugin XSS Vulnerability

CVE-2024-13404 Overview

The Link Library plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the searchll parameter. The flaw affects all versions up to and including 7.7.2. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. Exploitation requires user interaction, such as clicking a crafted link. When the target loads the malicious URL, the injected script executes in the victim's browser under the site's origin.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling credential theft, session hijacking, and administrative account compromise when a logged-in administrator is targeted.

Affected Products

Ylefebvre Link Library WordPress plugin versions up to and including 7.7.2
WordPress sites running the vulnerable link-library plugin
Any deployment exposing the plugin's search functionality to unauthenticated users

Discovery Timeline

2025-01-21 - CVE-2024-13404 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13404

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw in the Link Library WordPress plugin. The searchll request parameter is reflected back into the rendered HTML response without proper sanitization or output escaping. Attackers craft URLs that embed JavaScript payloads in the searchll parameter and deliver them via phishing, social engineering, or third-party site links.

When a user clicks the crafted link, the plugin renders the attacker-controlled string into the page. The browser then parses the injected markup and executes the JavaScript in the context of the vulnerable WordPress site. Reflected XSS in a plugin exposed to unauthenticated visitors expands the attack surface because no prior account or session is required to trigger the payload.

Root Cause

The root cause is missing input validation and improper output encoding when handling the searchll GET parameter. The plugin echoes user-controlled data into HTML output without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses(). This violates the standard WordPress secure coding pattern of escaping data at the point of output.

Attack Vector

Exploitation is network-based and requires no authentication. The attacker crafts a URL pointing to a page on the target WordPress site that includes a malicious searchll value containing JavaScript. The attacker then distributes the URL through email, chat, or malicious web content. When a victim, ideally an authenticated administrator, follows the link, the payload executes in the victim's browser and can perform actions on their behalf, exfiltrate cookies, or pivot to further site compromise.

No verified public proof-of-concept code has been released. The vulnerability mechanism follows the standard reflected XSS pattern documented in the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2024-13404

Indicators of Compromise

HTTP GET requests to WordPress pages containing the searchll parameter with encoded script tags, javascript: URIs, or event-handler attributes such as onerror and onload
Web server or WAF logs showing URL-encoded payloads containing %3Cscript or %3Cimg sequences targeting the plugin
Referer chains indicating users arriving at the site from external phishing infrastructure
Unexpected outbound requests from administrator browsers to attacker-controlled hosts following a page visit

Detection Strategies

Inspect access logs for requests containing the searchll query parameter with suspicious characters (<, >, ", ', =)
Deploy Web Application Firewall (WAF) rules that flag script-like content in query strings on pages served by the Link Library plugin
Monitor endpoint telemetry on administrator workstations for browser-driven anomalies following WordPress admin activity
Review WordPress plugin inventory and correlate installed versions against the vulnerable range at or below 7.7.2

Monitoring Recommendations

Enable verbose HTTP request logging on the WordPress reverse proxy or hosting layer
Alert on repeated requests to plugin endpoints with encoded angle brackets or javascript: schemes in query parameters
Correlate suspicious inbound requests with subsequent admin account changes, new user creation, or plugin installations

How to Mitigate CVE-2024-13404

Immediate Actions Required

Update the Link Library plugin to a version above 7.7.2 where the sanitization fix from the WordPress Plugin Change Log is applied
Audit WordPress user accounts and rotate credentials for administrators who may have clicked untrusted links
Review recent plugin, theme, and user changes for unauthorized modifications
Deploy WAF rules to block reflected script payloads in the searchll parameter until patching is complete

Patch Information

The vendor addressed the issue in a subsequent release, tracked in changeset 3225694 on the WordPress plugin repository. Site operators should apply the update through the WordPress plugin management interface or via WP-CLI. Verify the installed version after upgrade to confirm remediation.

Workarounds

Deactivate and remove the Link Library plugin if the patched version cannot be installed immediately
Restrict access to pages that render the plugin's search interface using host-level or CDN-level rules
Add a Content Security Policy (CSP) header that disallows inline scripts to reduce the impact of reflected XSS execution
Configure WAF signatures to block requests where searchll contains HTML control characters or scheme-based payloads

bash

# Configuration example: update the Link Library plugin via WP-CLI
wp plugin update link-library
wp plugin get link-library --field=version