Cpe:2.3:a:broken_link_checker_project:broken_link_checker:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3abroken_link_checker_projectbroken_link_checkerwordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 02 Sep 2026 09:12:31 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCVE-2026-75528 Stored XSS in Broken Link Checker WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-09-broken-link-checker-xss/Wed, 02 Sep 2026 09:12:31 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-broken-link-checker-xss/The Broken Link Checker WordPress plugin up to version 2.4.13 is vulnerable to Stored Cross-Site Scripting, allowing unauthenticated attackers to execute malicious scripts in the administrative session context.The Broken Link Checker plugin for WordPress, in versions up to and including 2.4.13, contains a security flaw resulting in Stored Cross-Site Scripting (XSS). The vulnerability stems from insufficient input sanitization and output escaping within the plugin's Comment Author URL and Link Log processing functions. An unauthenticated attacker can craft a malicious URL and submit it as a comment author link. When an administrator performs the plugin's standard "dismiss-and-recheck" workflow, the plugin fetches the malicious URL. The attacker's server then issues a redirect to a secondary URL containing an HTML/JavaScript payload. This payload is stored verbatim in the plugin's link log, where it executes upon being rendered in an administrative session. This vulnerability poses a significant risk to the integrity of the WordPress administrative environment.

Impact

Successful exploitation of CVE-2026-75528 allows an unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator's browser session. This could lead to account takeover, unauthorized administrative actions, or the injection of further malicious content into the site, impacting any WordPress installation using the vulnerable plugin version.

Recommendation

Update the Broken Link Checker plugin to the latest version, ensuring it exceeds 2.4.13. Security operations should review administrative access logs for unusual patterns involving the "dismiss-and-recheck" functionality and monitor web application firewall (WAF) logs for POST requests to WordPress comment submission endpoints containing non-standard URL schemes or script-like patterns.

]]>highadvisory