Search CVEs, research… / diras.sa

CVE-2026-75528: stored cross-site scripting in wpmudev Broken Link Checker

Unauthenticated attackers can store and later execute arbitrary web scripts in the Broken Link Checker WordPress plugin, enabling script execution in pages viewed by administrators or other users. CVE-2026-75528 affects Broken Link Checker 2.x, specifically version 2.4.13 and earlier. The issue arises when an attacker supplies a crafted comment author URL that is stored in the plugin's link log and later triggered after an administrator performs the plugin’s dismiss-and-recheck workflow.

Published Updated Source: CVE Program, NVD, FIRST EPSS

CVSS 3.1
7.2HIGH
EPSS
0.00527
CWE
CWE-79
KEV DUE DATE
Not listed
PATCH
Not yet

DIRAS TAKE

Urgent: this is a stored XSS that can be injected without login and there is no patch available for 2.4.13 and earlier, so immediately limit administrative exposure and avoid the plugin workflow that processes untrusted links.

What is CVE-2026-75528?

Unauthenticated attackers can store and later execute arbitrary web scripts in the Broken Link Checker WordPress plugin, enabling script execution in pages viewed by administrators or other users. CVE-2026-75528 affects Broken Link Checker 2.x, specifically version 2.4.13 and earlier. The issue arises when an attacker supplies a crafted comment author URL that is stored in the plugin's link log and later triggered after an administrator performs the plugin’s dismiss-and-recheck workflow. The weakness is classified as CWE-79 (Cross-site Scripting).

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Which versions of wpmudev Broken Link Checker are affected?

BRANCHAFFECTEDFIXED
2.x2.4.13 and earlier

Is CVE-2026-75528 being exploited?

There are no public reports of exploitation as of 2026-09-30.

How to fix CVE-2026-75528

  1. Deactivate the Broken Link Checker plugin until a vendor patch is available.
  2. Restrict administrative access to WordPress and the plugin UI to trusted IPs or VPNs.
  3. Avoid performing the plugin’s dismiss-and-recheck workflow on links from untrusted commenters.
  4. Monitor logs for suspicious redirects or unexpected link entries and apply vendor guidance when published.

Frequently asked questions

Is CVE-2026-75528 being actively exploited?

There are no public reports of active exploitation of CVE-2026-75528 as of 2026-09-30.

Which Broken Link Checker versions are affected by CVE-2026-75528?

Broken Link Checker 2.x is affected; specifically version 2.4.13 and earlier are listed as vulnerable.

Is there a patch for CVE-2026-75528?

No patch is listed for Broken Link Checker as of 2026-09-30; follow vendor guidance and apply mitigations until a fixed release is available.

Does CVE-2026-75528 require authentication?

The vulnerability allows unauthenticated attackers to inject payloads, though exploitation depends on an administrator later triggering the plugin’s dismiss-and-recheck workflow.

References