CVE-2026-75528: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wpmudev Broken Link Checker

CVE-2026-75528 is a stored cross-site scripting vulnerability in the Broken Link Checker plugin for WordPress, affecting all versions up to and including 2.4.13. The flaw is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the Comment Author URL field. An unauthenticated attacker can submit a crafted URL in a comment author field, which, after an administrator triggers the plugin's dismiss-and-recheck workflow, results in the attacker's JavaScript payload being stored verbatim in the link log and executed in the context of the administrator's browser.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of an administrator's browser, potentially leading to credential theft or unauthorized actions within the WordPress admin interface. The vulnerability requires administrator interaction with the plugin's workflow to trigger the stored payload execution. The CVSS score of 7.2 reflects a high severity with network attack vector, low attack complexity, no privileges or user interaction required for injection, and impact on confidentiality and integrity but not availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid performing the dismiss-and-recheck workflow on untrusted links submitted via comment author URLs. Monitoring for plugin updates from wpmudev and applying them promptly is recommended once available.