CVE-2021-39311: 
WordPress vulnerability analysis and mitigation

The link-list-manager WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category parameter found in the ~/llm.php file in versions up to and including 1.0. This vulnerability was discovered and reported by Wordfence, and was assigned CVE-2021-39311 on August 20, 2021 (CVE Details).

The vulnerability has been assigned a CVSS Score of 6.1 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The issue stems from insufficient input sanitization and output escaping of the category parameter in the llm.php file, which allows attackers to inject arbitrary web scripts (Wordfence Advisory).

If successfully exploited, this vulnerability allows attackers to inject arbitrary web scripts that execute when users access the affected pages. This could lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected users' browsers.

At the time of disclosure, no patch was available for this vulnerability. Site administrators using the link-list-manager plugin version 1.0 or earlier should consider removing or disabling the plugin until a security update is available.