{"id":"CVE-2026-78396","aliases":[],"cve":{"records":[{"id":"CVE-2026-78396","source":"WPScan","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-24T14:16:01.922Z","published":"2026-10-29T06:00:22.964Z","modified":"2026-10-29T10:56:08.584Z"}],"publishers":[{"name":"WPScan","role":"CNA","organizationId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","modified":"2026-10-29T06:00:22.964Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T10:56:08.584Z"}],"references":[{"url":"https://wpscan.com/vulnerability/0eab05a7-8426-40a6-b0ee-5ae3547b842a/","tags":["exploit","vdb-entry","technical-description"],"source":"WPScan"}],"weaknesses":[{"id":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T10:52:39.197421Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure","titleSource":"WPScan","descriptionSource":"WPScan","description":"The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it, allowing unauthenticated users to disclose the telephone number, e-mail address and submitter name stored with links that the settings set is configured not to display.","score":5.3,"severity":"medium","published":"2026-10-29T06:00:22.964Z","modified":"2026-10-29T10:56:08.584Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Unknown","name":"Link Library","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"7.10.0","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"WPScan","url":"https://www.cve.org/CVERecord?id=CVE-2026-78396"}],"remediation":[],"references":["https://wpscan.com/vulnerability/0eab05a7-8426-40a6-b0ee-5ae3547b842a/"],"sources":[{"name":"CVE","id":"CVE-2026-78396","modified":"2026-10-29T10:56:08.584Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-78396"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3}],"sourceAffected":[],"observedAt":"2026-10-29T14:44:30.649Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T02:55:33.139Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T07:25:33.271Z","attemptedAt":"2026-10-29T07:25:33.271Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-29T07:25:33.069Z","attemptedAt":"2026-10-29T07:25:33.069Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T07:25:32.490Z","attemptedAt":"2026-10-29T07:25:32.490Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T07:25:32.282Z","attemptedAt":"2026-10-29T07:25:32.282Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-112613","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112613","modified":"Oct 29, 2026, 6:30:38 AM","checkedAt":"2026-10-29T07:25:32.490Z"},{"source":"GitHub Advisory Database","id":"GHSA-v794-5r9j-cqr4","url":"https://github.com/advisories/GHSA-v794-5r9j-cqr4","modified":"2026-10-29T06:30:45Z","checkedAt":"2026-10-29T07:25:33.069Z"},{"source":"NVD","id":"CVE-2026-78396","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78396","modified":"2026-10-29T06:17:24.123","checkedAt":"2026-10-29T07:25:33.271Z"}],"aiSummary":{"text":"The Link Library WordPress plugin before 7.10.0 discloses sensitive information, including telephone numbers and email addresses, to unauthenticated users. The vulnerability occurs because the plugin does not verify link ownership. This allows unauthorized access to submitter information.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T08:56:43.491Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-78396"}]}}