CVE-2015-10098: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in Broken Link Checker Plugin up to 1.10.5 on WordPress. It has been rated as problematic. Affected by this issue is the function print_module_list/show_warnings_section_notice/status_text/ui_get_action_links. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.10.6 is able to address this issue. The name of the patch is f30638869e281461b87548e40b517738b4350e47. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225152.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-04-08T09:15Z
Repository: https://github.com/wp-plugins/broken-link-checker
Language: PHP
Files changed: core/core.php, includes/any-post.php, readme.txt
Commit date: 2015-04-20 15:04:14 +0000
Commit message: Fix a CSRF/XSS vulnerability caused by not escaping the URL returned by add_query_arg().

Version 1.10.6 (stable). 

git-svn-id: https://plugins.svn.wordpress.org/broken-link-checker/trunk@1139206 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/core/core.php b/core/core.php
index 6f78dcc..aeed527 100644
--- a/core/core.php
+++ b/core/core.php
@@ -1313,11 +1313,11 @@ class wsBrokenLinkChecker {
 			
 			if ( !empty($extra_settings) ){
 				
 				printf(
 					' | <a class="blc-toggle-link toggle-module-settings" id="toggle-module-settings-%s" href="#">%s</a>',
-					$module_id,
+					esc_attr($module_id),
 					__('Configure', 'broken-link-checker')
 				);
 				
 				//The plugin remembers the last open/closed state of module configuration boxes
 				$box_id = 'module-extra-settings-' . $module_id;		
@@ -2246,17 +2246,17 @@ class wsBrokenLinkChecker {
 				</div>',
 			__(
 				'The "Warnings" page lists problems that are probably temporary or suspected to be false positives.<br> Warnings that persist for a long time will usually be reclassified as broken links.',
 				'broken-link-checker'
 			),
-			add_query_arg($notice_name, '0'),
+			esc_attr(add_query_arg($notice_name, '0')),
 			_x(
 				'Hide notice',
 				'admin notice under Tools - Broken links - Warnings',
 				'broken-link-checker'
 			),
-			admin_url('options-general.php?page=link-checker-settings#blc_warning_settings'),
+			esc_attr(admin_url('options-general.php?page=link-checker-settings#blc_warning_settings')),
 			_x(
 				'Change warning settings',
 				'a link from the admin notice under Tools - Broken links - Warnings',
 				'broken-link-checker'
 			)
@@ -2781,11 +2781,11 @@ class wsBrokenLinkChecker {
 		if( $status['broken_links'] > 0 ){
 			$text .= sprintf( 
 				"<a href='%s' title='" . __('View broken links', 'broken-link-checker') . "'><strong>". 
 					_n('Found %d broken link', 'Found %d broken links', $status['broken_links'], 'broken-link-checker') .
 				"</strong></a>",
-			  	admin_url('tools.php?page=view-broken-links'), 
+			  	esc_attr(admin_url('tools.php?page=view-broken-links')),
 				$status['broken_links']
 			);
 		} else {
 			$text .= __("No broken links found.", 'broken-link-checker');
 		}
diff --git a/includes/any-post.php b/includes/any-post.php
index 49d542c..1b1f82c 100644
--- a/includes/any-post.php
+++ b/includes/any-post.php
@@ -430,18 +430,18 @@ class blcAnyPostContainer extends blcContainer {
 			if ( current_user_can( $post_type_object->cap->delete_post, $this->container_id ) ){
 				if ( $this->can_be_trashed() ) { 
 					$actions['trash'] = sprintf(
 						"<span class='trash'><a class='submitdelete' title='%s' href='%s'>%s</a>",
 						esc_attr(__('Move this item to the Trash')),
-						get_delete_post_link($this->container_id, '', false),
+						esc_attr(get_delete_post_link($this->container_id, '', false)),
 						__('Trash')
 					);
 				} else {
 					$actions['delete'] = sprintf(
 						"<span><a class='submitdelete' title='%s' href='%s'>%s</a>",
 						esc_attr(__('Delete this item permanently')),
-						get_delete_post_link($this->container_id, '', true),
+						esc_attr(get_delete_post_link($this->container_id, '', true)),
 						__('Delete')
 					);
 				}
 			}
 		}
diff --git a/readme.txt b/readme.txt
index cb7f2e8..55a7263 100644
--- a/readme.txt
+++ b/readme.txt
@@ -2,11 +2,11 @@
 Contributors: whiteshadow
 Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=A6P9S6CE3SRSW
 Tags: links, broken, maintenance, blogroll, custom fields, admin, comments, posts
 Requires at least: 3.2
 Tested up to: 4.2-beta
-Stable tag: 1.10.5
+Stable tag: 1.10.6
 
 This plugin will check your posts, comments and other content for broken links and missing images, and notify you if any are found. 
 
 == Description ==
 This plugin will monitor your blog looking for broken links and let you know if any are found.
@@ -97,10 +97,11 @@ To upgrade your installation
 1. Reactivate the plugin. Your settings will be retained from the previous version.
 
 == Changelog ==
 
 = 1.10.6 =
+* Fixed a serious CSRF/XSS vulnerability.
 * Switched to YouTube API v3. The old API version will be shut down on April 20, so the plugin needs to be updated to continue checking links to YouTube videos.
 * Fixed long URLs overflowing into adjacent table columns.
 * Fixed a few minor PHP strict-mode notices.
 * Added database character set to the "Show debug info" table.
 

Vulnerable code: 					$module_id,
			add_query_arg($notice_name, '0'),
			admin_url('options-general.php?page=link-checker-settings#blc_warning_settings'),
			  	admin_url('tools.php?page=view-broken-links'), 
						get_delete_post_link($this->container_id, '', false),
						get_delete_post_link($this->container_id, '', true),
Stable tag: 1.10.5
Fixed code: 					esc_attr($module_id),
			esc_attr(add_query_arg($notice_name, '0')),
			esc_attr(admin_url('options-general.php?page=link-checker-settings#blc_warning_settings')),
			  	esc_attr(admin_url('tools.php?page=view-broken-links')),
						esc_attr(get_delete_post_link($this->container_id, '', false)),
						esc_attr(get_delete_post_link($this->container_id, '', true)),
Stable tag: 1.10.6
* Fixed a serious CSRF/XSS vulnerability.