Vulnerability · Published Nov 4, 2025 · Assigned by GitHub_M

CVE-2025-62722LinkAce: Stored XSS Vulnerability in Link Title Field Through Social Media Sharing Feature

High 8.7

In plain English

A high-severity cross-site scripting in LinkAce from Kovah. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.3%top 81.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

LinkAce is a self-hosted archive to collect website links. In versions 2.3.1 and below, the social media sharing functionality contains a Stored Cross-Site Scripting (XSS) vulnerability that allows any authenticated user to inject arbitrary JavaScript by creating a link with malicious HTML in the title field. When a user views the link details page and the shareable links are rendered, the malicious JavaScript executes in their browser. This vulnerability affects multiple sharing services and can be exploited to steal session cookies, perform actions on behalf of users, or deliver malware. This issue is fixed in version 2.4.0.

Affected products (as reported)

Vendor	Product	Versions
Kovah	LinkAce	< 2.4.0

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

References

https://github.com/Kovah/LinkAce/security/advisories/GHSA-4mxh-7c7f-q79j x_refsource_CONFIRM
https://github.com/Kovah/LinkAce/commit/95d29b71ad9d4750cff8bbe7488802f6a4afa6aa x_refsource_MISC
https://github.com/Kovah/LinkAce/releases/tag/v2.4.0 x_refsource_MISC