CVE-2019-16521

The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encoding and insertion of an HTTP GET parameter into HTML. The filter function on the page listing all detected broken links can be exploited by providing an XSS payload in the s_filter GET parameter in a filter_id=search request. NOTE: this is an end-of-life product.

• CWE-79

• http://www.openwall.com/lists/oss-security/2019/10/16/3Exploit, Mailing List, Third Party Advisory
• https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190913-02_WordPress_Plugin_Broken_Link_CheckerExploit, Third Party Advisory
• https://wordpress.org/plugins/broken-link-checker/#developersProduct, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9917Third Party Advisory
• http://www.openwall.com/lists/oss-security/2019/10/16/3Exploit, Mailing List, Third Party Advisory
• https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190913-02_WordPress_Plugin_Broken_Link_CheckerExploit, Third Party Advisory
• https://wordpress.org/plugins/broken-link-checker/#developersProduct, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9917Third Party Advisory

Published

Oct 16, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16516An issue was discovered in ConnectWise Control (formerly kno…5.3
• CVE-2019-16517An issue was discovered in ConnectWise Control (formerly kno…9.8
• CVE-2019-16518An issue was discovered on Swell Kit Mod devices that use th…4.3
• CVE-2019-16519ESET Cyber Security 6.7.900.0 for macOS allows a local attac…7.8
• CVE-2019-1652A vulnerability in the web-based management interface of Cis…7.2
• CVE-2019-16520The all-in-one-seo-pack plugin before 3.2.7 for WordPress (a…5.4
• CVE-2019-16522The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU…4.8
• CVE-2019-16523The events-manager plugin through 5.9.5 for WordPress (aka E…5.4
• CVE-2019-16524The easy-fancybox plugin before 1.8.18 for WordPress (aka Ea…4.8
• CVE-2019-16525An XSS issue was discovered in the checklist plugin before 1…6.1
• CVE-2019-16528An issue was discovered in the AbuseFilter extension for Med…7.5
• CVE-2019-16529An issue was discovered in the CheckUser extension through 1…5.3