CVE-2019-16521: The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encoding and insertion of an HTTP GET parameter into HTML. The fil

medium Affects broken-link-checker (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2019-10-16; advisory modified 2026-06-17.

The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encoding and insertion of an HTTP GET parameter into HTML. The fil

Package: broken-link-checker (WordPress plugin) WordPress
Affected versions: <=1.11.8
Fixed in: no fix recorded
Severity: medium CVSS 6.1
Exploitation: not on CISA KEV · EPSS 1% (72.3th percentile)
Published: 2019-10-16
Source: nvd

References

CWE-79

NVD record broken-link-checker (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2022-2438 high The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted same package: broken-link-checker (WordPress plugin)
CVE-2019-17207 medium A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken- same package: broken-link-checker (WordPress plugin)
CVE-2015-5057 medium Cross-site scripting (XSS) vulnerability exists in the Wordpress admin panel when the Brok same package: broken-link-checker (WordPress plugin)
CVE-2015-10098 low A vulnerability was found in Broken Link Checker Plugin up to 1.10.5 on WordPress. It has same package: broken-link-checker (WordPress plugin)
CVE-2014-125105 low A vulnerability was found in Broken Link Checker Plugin up to 1.10.1 on WordPress. It has same package: broken-link-checker (WordPress plugin)
CVE-2022-3922 medium The Broken Link Checker WordPress plugin before 1.11.20 does not sanitise and escape some same package: broken-link-checker (WordPress plugin)