CVE-2026-75528

The Broken Link Checker plugin for WordPress in all versions up to and including 2.4.13 has insufficient input sanitization and output escaping in its link log, enabling unauthenticated stored cross-site scripting (XSS). An attacker submits a WordPress comment whose author URL points to a server they control; when an administrator runs the plugin's standard dismiss-and-recheck workflow on that link, the attacker's HTTP server responds with a redirect to a URL containing HTML/JavaScript, which is stored verbatim in the link log. The injected script then executes whenever a user accesses the affected page, allowing the attacker to run arbitrary web script in the browsers of site users and administrators, consistent with the 'changed' scope (C:L/I:L) in the 7.2 high CVSS 3.1 score. Any WordPress site running the plugin at version 2.4.13 or earlier is affected. No exploitation is currently known: there is no public proof of concept, the flaw is not in CISA KEV, and EPSS assigns a 0.3% probability of exploitation in the next 30 days.

What to do: Update Broken Link Checker to a release newer than 2.4.13 as soon as the patched version is available. Until then, exercise caution when dismissing or rechecking links to unfamiliar domains, review the link log for entries containing HTML or script tags in redirected URLs, and moderate comments with unknown author URLs. If immediate patching is not possible, temporarily disabling the plugin or replacing it removes the attack path.