vulnerability

WordPress Plugin: broken-link-checker: CVE-2019-17207: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:S/C:N/I:P/A:N)

Published

Oct 14, 2019

Added

May 15, 2025

Modified

May 5, 2026

Description

A reflected XSS vulnerability was found in includes/admin/table-printer.php in the Broken Link Checker plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the wp-admin/tools.php?pageequal toview-broken-links s_filter parameter in a search action.

Solution

broken-link-checker-plugin-cve-2019-17207

References

https://www.cve.org/CVERecord?id=CVE-2019-17207
https://www.wordfence.com/threat-intel/vulnerabilities/id/58b59e65-420c-45f5-a34c-2d2003f4e3ae?source=api-prod
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-7629
CVE-2019-17207
https://attackerkb.com/topics/CVE-2019-17207
CWE-79
EUVD-EUVD-2019-7629

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report