LinkAce is a self-hosted archive to collect website links. A stored cross-site scripting (XSS) vulnerability was discovered in versions prior 2.1.9 that allows an attacker inject arbitrary JavaScript, which then executed the context of user's browser when malicious link clicked. This one-click XSS, meaning victim only needs click crafted — no further interaction required. The application contains XSS due insufficient filtering and escaping user-supplied data inserted into attributes. Malicious JavaScript code can be saved database along with user’s clicking link, leading script execution within site. Version fixes issue.