CVE-2026-75528

The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to perform the plugin's standard dismiss-and-recheck workflow on a link submitted by the attacker via the WordPress comment author URL field, after which the attacker's HTTP server issues a redirect to a URL containing an HTML/JavaScript payload that is stored verbatim in the link log.

• CWE-79

• https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.13/legacy/includes/admin/table-printer.php#L658
• https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.13/legacy/includes/links.php#L485
• https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.13/legacy/modules/checkers/http.php#L291
• https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.13/legacy/modules/checkers/http.php#L432
• https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.13/legacy/modules/containers/comment.php#L228
• https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.8/legacy/includes/admin/table-printer.php#L658
• https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.8/legacy/includes/links.php#L485
• https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.8/legacy/modules/checkers/http.php#L291
• https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.8/legacy/modules/checkers/http.php#L432
• https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.8/legacy/modules/containers/comment.php#L228
• https://plugins.trac.wordpress.org/changeset?old_path=%2Fbroken-link-checker/tags/2.4.13&new_path=%2Fbroken-link-checker/tags/2.4.13.1
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3662785%40broken-link-checker%2Ftags%2F2.4.13.1&old=3644192%40broken-link-checker%2Ftags%2F2.4.13
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ec96308f-3944-48c5-94be-b1555c0830b7?source=cve

Published

Sep 2, 2026

Last Modified

Sep 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75501A vulnerability in the Calix EXOS firmware for the GS7 XGS (…7.5
• CVE-2026-75509joserfc is a Python library that provides an implementation …6.5
• CVE-2026-7551HKUDS OpenHarness contains a remote code execution vulnerabi…8.8
• CVE-2026-75514BunkerWeb is an open-source, next-generation Web Application…5.9
• CVE-2026-7552The Geo Mashup plugin for WordPress is vulnerable to authori…5.3
• CVE-2026-75526django CMS is an easy-to-use and developer-friendly enterpri…4.4
• CVE-2026-75529Pandora is affected by a stored cross-site scripting vulnera…6.9
• CVE-2026-7553A vulnerability was found in code-projects Gym Management Sy…4.7
• CVE-2026-75531Pandora contains a stored cross-site scripting (XSS) vulnera…7
• CVE-2026-75538An attacker that connects to an open Erlang TCP port that us…8.2
• CVE-2026-7554A vulnerability was determined in D-Link M60 up to 1.20B02. …8.1
• CVE-2026-75542Incorrect Authorization vulnerability in the OAuth token end…8.3