What the vulnerability does
01Description
A vulnerability was found in Broken Link Checker Plugin up to 1.10.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function options_page of the file core/core.php of the component Settings Page. The manipulation of the argument exclusion_list/blc_custom_fields leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.10.2 is able to address this issue. The patch is named 90615fe9b0b6f9e6fb254d503c302e53a202e561. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230659.
Explanation of Vulnerability in Simple Terms
02Summary
The Broken Link Checker plugin contains a stored cross-site scripting (XSS) vulnerability in versions 1.10.0 and earlier. An authenticated administrator with high privileges can inject malicious scripts through the plugin's interface. When other users view affected pages, the injected script executes in their browser, potentially compromising their session or stealing data.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that execute when other users view the site.
Potential impact on your site
04Site Impact
Administrators can inject scripts affecting other users' sessions and data; requires admin access to exploit.
Conditions required to exploit
05Prerequisites
Attacker must be an authenticated administrator; victim must visit an affected page.
Key dates
06Disclosure timeline
June 5, 2023
CVE published
August 6, 2024
Record updated
