CVE-2019-16521: managewp broken_link_checker Cross-site Scripting
Vulnerability summary
CVE-2019-16521 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in managewp broken_link_checker. EPSS estimates a 1.40% chance of exploitation in the next 30 days, higher than 72% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 16-10-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encoding and insertion of an HTTP GET parameter into HTML. The filter function on the page listing all detected broken links can be exploited by providing an XSS payload in the s_filter GET parameter in a filter_id=search request. NOTE: this is an end-of-life product.
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
1.40%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
0.00 pp
From 1.40% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundAdvisories
Maturity: poc
Exploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Managewp1 product
- broken_link_checker≤ 1.11.8
Wordpress1 product
- broken-link-checker< 1.11.9
2 vendors · 2 products
References
5 links- www.openwall.com/lists/oss-security/2019/10/16/3Mailing ListX Refsource MLISTExploitThird Party Advisory