Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
wp-plugins/broken-link-checker
master @ 63d50a3
9
Fixes
0
CVEs
HIGH
Peak severity
40.0%
Coverage
Highlights
Reflected XSS: 3 prior fixes. Scrutinize any change in this area.
core/core.php: most-fixed (6 issues). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Remote Code Execution: Users with bulk-edit rights could execute arbitrary PHP code because of unescaped regular expression delimiters in search-and-replace routines. Secure this by consistently escaping user-controlled delimiters using preg_quote or avoiding dynamic regex creation entirely.
Stored XSS: Unsanitized input from configuration parameters and custom filter names was stored and rendered back into HTML attributes and text areas. Developers should enforce HTML tag stripping and apply esc_attr and esc_textarea during output rendering.
Reflected XSS: Form action URLs and query parameters like sorting parameters were printed directly into the page markup without validation, facilitating reflected script injection. Always escape dynamic URLs with esc_url or esc_html before printing.