Broken Link Checker

Broken Link Checker through 2.4.14 allows an Editor to make the WordPress server issue an attacker-influenced outbound request. Reachable internal or external services may be contacted with the server's network position.

Broken Link Checker through 2.4.13 can store an unauthenticated attacker's redirected comment-author URL in its link log without safe output handling. After an Administrator dismisses and rechecks the submitted link, the redirect target is stored and script executes when the affected log view is opened.

Broken Link Checker before 2.4.12 does not constrain query variables accepted from unauthenticated requests on sites using plain permalinks. An attacker can overwrite arbitrary PHP global variables; when a classic, non-block theme is active, the resulting state can execute arbitrary server-side code.

Broken Link Checker is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 2.4.7.

Broken Link Checker is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.

Broken Link Checker is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests.

Broken Link Checker is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Broken Link Checker is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Broken Link Checker is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Broken Link Checker is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Broken Link Checker is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Broken Link Checker is affected by code execution. Exploitation requires an authenticated WordPress account. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

Broken Link Checker is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Broken Link Checker is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Broken Link Checker is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.