WordPress Plugin Vulnerabilities

Broken Link Checker <= 1.10.2 - Stored XSS

Description

Broken Link Checker is vulnerable to stored XSS (again). The plugin don’t check the links on their validity. Very bad: JavaScript code is a valid link. Example: <a href="javascript:alert(1)">Link</a>.
Malicious JavaScript can be injected by any post author.

Screenshots: http://imgur.com/mTEobu7 / http://imgur.com/3z8GmL0 / http://imgur.com/KLSTP3S

Affects Plugins

Plugin icon
broken-link-checker
Fixed in 1.10.3

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79

Miscellaneous

Submitter
SecuBeastTeam
Verified
No
WPVDB ID
b81639a2-c281-4d9f-a084-f845ab85d225

Timeline

Publicly Published
2014-12-05 (about 11 years ago)
Added
2019-12-02 (about 6 years ago)
Last Updated
2019-12-02 (about 6 years ago)

Other

Published
Title
Published
2020-08-10
Title
RSS Feed Widget < 2.8.1 - Authenticated Cross-Site Scripting (XSS)
Published
2021-05-05
Title
Target First Plugin 2.0 - Unauthenticated Stored XSS via Licence Key
Published
2021-11-29
Title
WP Remote < 4.65 - Reflected Cross-Site Scripting
Published
2023-08-21
Title
Simple URLs < 118 - Reflected XSS
Published
2022-06-06
Title
miniOrange's Malware Scanner < 4.5.2 - Admin+ Stored Cross-Site Scripting