CVE-2026-75528: Broken Link Checker WordPress Plugin XSS

CVE-2026-75528 Overview

The Broken Link Checker plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 2.4.13. The flaw stems from insufficient input sanitization and output escaping in the plugin's link log display. Unauthenticated attackers can inject arbitrary JavaScript that executes when administrators view the affected plugin pages. Exploitation requires an administrator to perform the plugin's standard dismiss-and-recheck workflow against a link submitted through the WordPress comment author URL field. The attacker-controlled server then issues an HTTP redirect containing an HTML/JavaScript payload that is stored verbatim in the link log. The vulnerability is classified under CWE-79.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes in an administrator's browser session, enabling account takeover, privilege escalation, and further compromise of the WordPress site.

Affected Products

WordPress Broken Link Checker plugin versions up to and including 2.4.13
Fixed in version 2.4.13.1
All WordPress sites running the affected plugin with comments enabled

Discovery Timeline

2026-09-02 - CVE-2026-75528 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-75528

Vulnerability Analysis

The vulnerability resides in the Broken Link Checker plugin's handling of URLs submitted through the WordPress comment author URL field. When the plugin crawls those URLs to verify their status, it stores the final resolved URL in the link log without adequate sanitization. Affected code paths include legacy/modules/checkers/http.php, legacy/includes/links.php, and the admin rendering routine in legacy/includes/admin/table-printer.php.

When an administrator reviews link status, the stored URL is emitted into the admin page. Because the output is not properly escaped, embedded HTML and JavaScript execute in the administrator's authenticated session. The exploitation flow abuses a legitimate administrative workflow: dismiss-and-recheck. This triggers a fresh HTTP request to the attacker's server, which then returns a redirect (Location: header) containing the payload.

Root Cause

The plugin trusts the URL returned by the HTTP checker after following redirects. Instead of validating that the destination is a well-formed URL or escaping it on output using functions such as esc_url() or esc_attr(), the plugin writes the redirect target directly into its link log table and renders it into HTML attributes on the admin page.

Attack Vector

An unauthenticated attacker submits a comment on a target WordPress site containing an attacker-controlled URL in the comment author URL field. The attacker's server responds to the plugin's link-check request with an HTTP redirect whose Location header contains an XSS payload rather than a valid URL. When an administrator uses the plugin's dismiss-and-recheck action, the payload is fetched, stored in the link log, and rendered in the admin interface, where it executes with administrator privileges.

See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-75528

Indicators of Compromise

Comments from unauthenticated users containing suspicious or malformed URLs in the author URL field
Entries in the Broken Link Checker link log where the stored URL contains HTML tags, javascript: schemes, or event handlers such as onerror= or onload=
Outbound HTTP requests from the WordPress host to previously unseen domains during link-check operations
Unexpected administrator sessions, new admin accounts, or modified plugin/theme files following administrator use of the Broken Link Checker interface

Detection Strategies

Audit the wp_blc_links database table for stored URLs that contain characters such as <, >, ", or script substrings
Review WordPress access logs for redirect responses received by the plugin's HTTP checker module
Monitor for JavaScript execution in /wp-admin/ pages served by the Broken Link Checker plugin using browser-side Content Security Policy (CSP) reporting

Monitoring Recommendations

Enable and forward WordPress audit logs to a centralized logging platform for correlation of comment submissions and admin activity
Alert on newly created administrator accounts or role changes shortly after admin interaction with plugin management pages
Track outbound connections from the web server to non-corporate destinations initiated by PHP worker processes

How to Mitigate CVE-2026-75528

Immediate Actions Required

Update the Broken Link Checker plugin to version 2.4.13.1 or later on all WordPress installations
Review the plugin's link log and remove any entries containing suspicious URLs or embedded HTML
Audit administrator accounts and recent admin activity for signs of compromise, including new users and modified files
Rotate administrator credentials and invalidate active sessions if suspicious link log entries are found

Patch Information

The vendor released a fix in Broken Link Checker version 2.4.13.1. The WordPress Changeset for Version Update contains the code changes that add proper sanitization and output escaping to the affected code paths. Site operators should enable automatic plugin updates in WordPress to reduce exposure to similar issues.

Workarounds

Deactivate the Broken Link Checker plugin until patching is complete
Disable comments site-wide or require moderation for all comments to prevent unauthenticated submission of malicious URLs
Deploy a Web Application Firewall (WAF) rule that blocks comment submissions containing suspicious URL patterns
Apply a strict Content Security Policy (CSP) in the WordPress admin interface to limit inline script execution

bash

# Update the plugin via WP-CLI
wp plugin update broken-link-checker --version=2.4.13.1

# Verify installed version
wp plugin get broken-link-checker --field=version

# Optional: temporarily deactivate until patched
wp plugin deactivate broken-link-checker