WordPress Plugin Vulnerabilities

Broken Link Checker < 2.2.4 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Affects Plugins

Plugin icon
broken-link-checker
Fixed in 2.2.4

References

CVE
CVE-2024-25592
URL
https://patchstack.com/database/vulnerability/broken-link-checker/wordpress-broken-link-checker-plugin-2-2-3-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Dhabaleshwar Das
Verified
No
WPVDB ID
a837bb5a-0270-49e5-806a-ab733f0e094a

Timeline

Publicly Published
2024-02-12 (about 3 months ago)
Added
2024-02-15 (about 3 months ago)
Last Updated
2024-02-15 (about 3 months ago)

Other

Published
Title
Published
2024-02-27
Title
ArtiBot Free Chat Bot for WordPress WebSites <= 1.1.6 - Authenticated (Admin+) Cross-Site Scripting
Published
2023-10-12
Title
Easy Testimonial Slider and Form < 1.0.19 - Admin+ Stored XSS
Published
2020-03-05
Title
Contact Form by WPForms < 1.5.9 - Authenticated Cross-Site Scripting (XSS)
Published
2023-05-19
Title
Groundhogg < 2.7.10 - Contributor+ Stored XSS
Published
2023-11-27
Title
Simple Long Form <= 2.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting