WordPress Plugin Vulnerabilities

Broken Link Checker 1.10.1 - Authenticated Stored XSS

Description

On the "Settings > Link Checker > Which Links To Check" screen, the input field 'exclusion_list' is saved without any validation. Malicious JavaScript can be injected.

Screenshots:
http://imgur.com/PsvPQRy
http://imgur.com/nH6GdVN

Affects Plugins

Plugin icon
broken-link-checker
Fixed in 1.10.2

References

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79

Miscellaneous

Submitter
SecuBeastTeam
Verified
No
WPVDB ID
99258440-d693-403c-b4d6-0cae821062d9

Timeline

Publicly Published
2014-12-04 (about 11 years ago)
Added
2014-12-04 (about 11 years ago)
Last Updated
2019-10-21 (about 6 years ago)

Other

Published
Title
Published
2024-12-13
Title
Import Eventbrite Events < 1.7.5 - Reflected Cross-Site Scripting
Published
2025-05-19
Title
ElementInvader Addons for Elementor < 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-03-25
Title
ReviewX < 1.6.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-01-07
Title
Competition Form <= 2.0 - Reflected XSS
Published
2024-03-18
Title
MJM Clinic < 1.1.23 - Authenticated (Administrator+) Stored Cross-Site Scripting