TI-2021-07370 Aliases CVE-2021-25092 GHSA-79qc-m83g-g4j5

Link Library < 7.2.8 - Library Settings Reset via CSRF

LOW 29CWE-352Published 2022-02-01 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

The Link Library WordPress plugin before 7.2.8 does not have CSRF check when resetting library settings, allowing attackers to make a logged in admin reset arbitrary settings via a CSRF attack

Why it matters now

EPSS 0.0048 41st percentileScored 2026-11-07

Fix Fixed Link Library (Unknown): 7.2.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Link Library	7.2.8 to before 7.2.8	7.2.8	Patch available	CNA

Link Library VendorUnknown Affected 7.2.8 to before 7.2.8 Fixed in 7.2.8 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ylefebvre:link_library::::::wordpress::*	before 7.2.8	Vulnerable	jackdewey

cpe:2.3:a:ylefebvre:link_library:*:*:*:*:*:wordpress:*:* Versions before 7.2.8 Vulnerable ·jackdewey

Remediation

Fix · CNA Link Library (Unknown) Fixed in 7.2.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-02-01
Link Library 7.2.8
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-07371 Link Library < 7.2.8 - Unauthenticated Arbitrary Links DeletionPriority LOW 35
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2021-25092
2026-10-03 Alias added: GHSA-79qc-m83g-g4j5

References

Advisory 1

https://wpscan.com/vulnerability/1cd30913-67c7-46c3-a2de-dcca0c332323

TI-2022-03844 Link Library < 7.4.1 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
TI-2024-16389 WordPress Link Library Plugin <= 7.5.13 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
TI-2024-01455 Link Library <= 7.6 - Unauthenticated Stored Cross-Site Scripting CVSS 3.1MEDIUM 6.5
TI-2021-07371 Link Library < 7.2.8 - Unauthenticated Arbitrary Links Deletion CVSS 3.1HIGH 7.5
TI-2024-19297 WordPress Link Library plugin <= 7.6 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
TI-2024-25945 WordPress Link Library plugin <= 7.7.1 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences