Stored Cross-Site Scripting in Broken Link Checker for WordPress

CVE-2026-75528

What is CVE-2026-75528?

The Broken Link Checker plugin for WordPress is prone to a Stored Cross-Site Scripting vulnerability through the Comment Author URL and Link Log features. This issue arises from inadequate input sanitization and output escaping practices, enabling unauthenticated attackers to inject malicious web scripts into vulnerable pages. When a WordPress administrator executes the standard dismiss-and-recheck workflow for a link submitted by an attacker, the attacker can exploit this flaw to redirect users to a malicious URL containing harmful JavaScript code. This security risk underscores the importance of robust input validation and proper output handling in web applications.

References