CVE-2024-35687: Link Library Reflected XSS Vulnerability

CVE-2024-35687 Overview

CVE-2024-35687 is a reflected cross-site scripting (XSS) vulnerability in the Yannick Lefebvre Link Library plugin for WordPress. The flaw affects all versions of link-library up to and including 7.6.3. The plugin fails to properly neutralize user-supplied input before rendering it in generated web pages, allowing attackers to inject arbitrary JavaScript. Exploitation requires user interaction, typically by luring a victim to click a crafted URL. Successful attacks execute script in the victim's browser under the trust context of the vulnerable WordPress site.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, and redirection to malicious infrastructure when targeting authenticated WordPress users.

Affected Products

Yannick Lefebvre Link Library WordPress plugin versions through 7.6.3
WordPress sites running ylefebvre/link_library plugin
Any site exposing vulnerable Link Library endpoints to unauthenticated users

Discovery Timeline

2024-06-08 - CVE-2024-35687 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35687

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw classified under CWE-79, Improper Neutralization of Input During Web Page Generation. The Link Library plugin accepts input from HTTP request parameters and reflects that data into the server's HTTP response without adequate output encoding or input sanitization. When a victim clicks an attacker-crafted link, the injected payload executes in the browser under the origin of the vulnerable WordPress site.

Exploitation is network-reachable and requires no authentication, but does require user interaction to trigger the reflected payload. The attack crosses a trust boundary because the injected script runs within the same-origin context of the WordPress site, giving it access to session cookies, DOM contents, and any authenticated actions the victim can perform.

Root Cause

The root cause is missing or insufficient sanitization of request parameters before they are echoed back into the rendered HTML response. The plugin does not apply WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses() to values sourced from $_GET or $_REQUEST prior to output. This allows raw HTML and JavaScript payloads to be included verbatim in the response body.

Attack Vector

An attacker crafts a URL targeting a vulnerable Link Library endpoint on the WordPress host and embeds a JavaScript payload in a reflected parameter. The attacker then delivers the URL through phishing email, social media, or a malicious redirect. When an authenticated WordPress administrator clicks the link, the payload runs in their browser and can steal session cookies, perform administrative actions, or pivot to plugin-level configuration changes. See the Patchstack Advisory: XSS Vulnerability for technical details of the vulnerable parameter and payload structure.

Detection Methods for CVE-2024-35687

Indicators of Compromise

HTTP requests to Link Library plugin endpoints containing URL-encoded <script> tags, javascript: URIs, or event handler attributes such as onerror= and onload=
Web server access logs showing unusually long query strings with HTML entities or JavaScript keywords targeting link-library paths
Referer headers indicating traffic originated from external phishing domains or URL shorteners
Unexpected outbound requests from administrator browsers to attacker-controlled hosts shortly after visiting a WordPress admin page

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect query parameters for XSS payload signatures targeting WordPress plugin endpoints
Enable WordPress plugin auditing to inventory installed versions of link-library and flag installations at or below 7.6.3
Correlate reflected-XSS payload patterns in HTTP logs with subsequent administrator session activity from unusual IP addresses

Monitoring Recommendations

Ingest WordPress web server and plugin logs into a centralized analytics platform and alert on script-like content in Link Library request parameters
Monitor for administrator account changes, new user creations, and plugin modifications occurring within minutes of suspicious inbound clicks
Track browser telemetry from privileged users for anomalous outbound connections and script execution on WordPress admin pages

How to Mitigate CVE-2024-35687

Immediate Actions Required

Inventory all WordPress instances and identify sites running the Link Library plugin at version 7.6.3 or earlier
Update Link Library to a fixed version above 7.6.3 as published by the vendor; if no patched release is available, deactivate and remove the plugin
Force password resets and terminate active sessions for WordPress administrators who may have clicked suspicious links
Review recent administrative actions, user creations, and plugin or theme changes for signs of exploitation

Patch Information

The vulnerability affects Link Library versions through 7.6.3. Consult the Patchstack Advisory: XSS Vulnerability and the plugin's WordPress.org listing for the current fixed release. Apply the vendor-supplied patch through the WordPress admin plugin updater or by replacing plugin files with the patched version.

Workarounds

Deactivate the Link Library plugin until a patched version is installed
Deploy WAF rules that block requests to link-library endpoints containing HTML tags, JavaScript keywords, or event handler attributes in query parameters
Enforce a strict Content Security Policy (CSP) that restricts inline script execution on WordPress pages to limit the impact of reflected payloads
Restrict administrator access to WordPress dashboards using IP allowlisting or VPN-only access to reduce the pool of high-value XSS targets

bash

# Example nginx rule blocking script-like payloads to Link Library endpoints
location ~* /wp-content/plugins/link-library/ {
    if ($args ~* "(<|%3C)script|javascript:|onerror=|onload=") {
        return 403;
    }
}