Description

The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to perform the plugin's standard dismiss-and-recheck workflow on a link submitted by the attacker via the WordPress comment author URL field, after which the attacker's HTTP server issues a redirect to a URL containing an HTML/JavaScript payload that is stored verbatim in the link log.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-02T08:16:45.193Z",
  "pubdate": "2026-09-02T08:16:45.193Z",
  "executiveSummary": "The Broken Link Checker plugin for WordPress, in versions up to and including 2.4.13, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw originates from insufficient sanitization of input data and inadequate output escaping within the plugin's link log functionality.\nThe vulnerability allows unauthenticated attackers to execute arbitrary JavaScript within the administrative context of a WordPress site. By submitting a malicious URL through a comment author field, an attacker can influence the plugin's internal link monitoring process.\nSuccessful exploitation requires an administrator to interact with the plugin's interface to process the attacker's link. Once triggered, the attacker's server delivers a malicious payload, which is then stored verbatim by the plugin and executed upon viewing the logs.\nThe primary impact involves unauthorized script execution within the administrator's session, which could lead to administrative account compromise, unauthorized configuration changes, or further site exploitation. Given the requirement for administrator interaction, the attack remains a significant risk for sites where link monitoring workflows are frequently utilized.",
  "technicalDetails": "The vulnerability resides in the link log management component of the Broken Link Checker plugin. The root cause is a failure to properly sanitize the 'Link URL' data source before storing it in the database and a corresponding lack of output escaping when rendering this data in the administrative dashboard.\nThe attack flow begins with an unauthenticated threat actor targeting the 'Website' field within a standard WordPress comment form. The attacker submits a URL that points to an external server controlled by the attacker. This external server is configured to perform an HTTP redirect. When the plugin's background link-checking process (or an administrator-triggered 're-check' workflow) fetches the submitted URL, the attacker's server responds with a redirect header pointing to a malicious URL containing a JavaScript or HTML payload.\nBecause the plugin logs the final destination of detected links, the malicious payload provided in the redirect URL is stored directly into the WordPress database without being processed or escaped for web context. The data remains dormant until an administrator accesses the plugin's interface to view the link logs or performs the 'dismiss-and-recheck' workflow. At this point, the administrative browser renders the stored, malicious content, executing the arbitrary JavaScript within the context of the administrator's authenticated session.\nThe exploitation allows for the execution of arbitrary code within the WordPress administrative panel. Because this occurs within the admin session, an attacker can perform any action the administrator is authorized to take, such as creating new administrative users, modifying plugin settings, or injecting further malicious code into the site's theme or core files. The network exposure is broad, as it relies on public-facing comment forms, making it accessible to any unauthenticated visitor who can submit a comment. The vulnerability is explicitly tied to the interaction between the plugin's automated link-verification logic and the administrative manual review process."
}