EUVD-2026-69889
GHSA-qpv7-fm86-f6w8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
UI:R corrects the submitted UI:N; admin must actively trigger dismiss-and-recheck for payload delivery; unauthenticated comment submission keeps PR:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to perform the plugin's standard dismiss-and-recheck workflow on a link submitted by the attacker via the WordPress comment author URL field, after which the attacker's HTTP server issues a redirect to a URL containing an HTML/JavaScript payload that is stored verbatim in the link log.
AnalysisAI
Stored XSS in the Broken Link Checker WordPress plugin (versions ≤ 2.4.13) allows unauthenticated attackers to inject persistent JavaScript into the WordPress admin link log via a multi-hop redirect-based payload delivery mechanism. The plugin's HTTP checker follows attacker-controlled redirects and stores the redirect destination URL verbatim in the link log without sanitization; the admin table printer then renders this unsanitized content to any administrator who views the link log. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following specific conditions to be met: (1) Broken Link Checker plugin version 2.4.13 or earlier must be installed and active on the WordPress site; (2) WordPress comment submission must be enabled on at least one post so the attacker can inject a malicious comment author URL without authentication; (3) an administrator must explicitly invoke the dismiss-and-recheck workflow on the attacker-submitted link entry within the plugin's admin interface - this is a deliberate action, not passive page load; (4) the attacker must operate or control an HTTP server reachable by the WordPress server at the time of the recheck, capable of issuing an HTTP redirect response to a URL containing the HTML/JavaScript payload. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The submitted CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) contains a material discrepancy: UI:N (no user interaction required) conflicts directly with the description, which explicitly states exploitation requires an administrator to perform the dismiss-and-recheck workflow. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Broken Link Checker plugin to version 2.4.13.1 or later, which addresses the insufficient input sanitization and output escaping identified in this CVE. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations using Broken Link Checker plugin and determine current versions to assess organizational exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Broken Link Checker
View allThe broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS du
Unauth. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low
A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link
The Broken Link Checker WordPress plugin before 1.11.20 does not sanitise and escape some of its settings, which could a
The Broken Link Checker WordPress plugin before 2.4.2 does not validate a the link URLs before making a request to them,
Blind SQL injection in WPMU DEV Broken Link Checker WordPress plugin versions ≤2.4.7 allows authenticated high-privilege
The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' val
Cross-site scripting (XSS) vulnerability exists in the Wordpress admin panel when the Broken Link Checker plugin before
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Broken Li
Server-Side Request Forgery in the Broken Link Checker WordPress plugin (WPMU Dev, versions ≤ 2.4.14) allows high-privil
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today