CVE-2026-75528

Name of the Vulnerable Software and Affected Versions Broken Link Checker versions prior to 2.4.14

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. An attacker can submit a link via the WordPress comment author URL field; if an administrator performs the standard dismiss-and-recheck workflow, the attacker's server can issue a redirect to a URL containing an HTML/JavaScript payload. This payload is stored verbatim in the link log and executes whenever a user accesses the affected page.

Recommendations Update to a version newer than 2.4.13.