CVE-2026-2288

Vulnerability

The myLinksDump plugin for WordPress versions up to and including 1.6 is vulnerable to Stored Cross-Site Scripting (XSS) via the link_title parameter. The plugin stores user-supplied link titles and later outputs them without proper sanitization or escaping, as seen in the code where $ldlink['title'] is concatenated directly into HTML output [1][2]. This vulnerability affects all installations where unfiltered_html has been disabled (typical on multisite networks), and requires the attacker to have administrator-level access.

Exploitation

An authenticated attacker with administrator privileges can inject arbitrary JavaScript payloads into the link_title field when adding or editing a link. The injected script is stored in the database and subsequently rendered on any page displaying the link archive (e.g., via myLinksDump_Archive function). The attack does not require any user interaction beyond normal page views, as the payload executes automatically when a victim visits an affected page [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary web scripts in the context of any user who views the injected page. This can lead to session hijacking, credential theft, defacement, or further malicious actions within the WordPress admin dashboard. The attack impacts both confidentiality and integrity, and the scope is limited to users who can access the compromised pages [1][2].

Mitigation

The vendor has not yet released a patched version for myLinksDump. As of the publication date (2026-05-27), no fixed version is available. Administrators should consider disabling the plugin on multisite installations or ensuring that unfiltered_html is not enabled for untrusted administrators. No workaround is documented in the available references [1][2].