CVE-2019-16521

MEDIUM EPSS 69.0%
Published Oct 16, 20196y ago · Modified Jun 17, 20262w ago
6.1 CVSS 3.1
Medium
Find Similar
Published Oct 16, 2019 6y ago
Last Modified Jun 17, 2026 2w ago

Description

The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encoding and insertion of an HTTP GET parameter into HTML. The filter function on the page listing all detected broken links can be exploited by providing an XSS payload in the s_filter GET parameter in a filter_id=search request. NOTE: this is an end-of-life product.

CVSS Details

Base Score
6.1
Exploitability
2.8
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
69.0% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
managewpbroken_link_checker* ≤1.11.8

References 4

  • openwall.com http://www.openwall.com/lists/oss-security/2019/10/16/3
    ExploitMailing ListThird Party Advisory
  • github.com https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190913-02_WordPress_Plugin_Broken_Link_Checker
    ExploitThird Party Advisory
  • wordpress.org https://wordpress.org/plugins/broken-link-checker/#developers
    ProductThird Party Advisory
  • wpvulndb.com https://wpvulndb.com/vulnerabilities/9917
    Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.