The Broken Link Manager WordPress plugin up to version 0.6.5 fails to sanitize and escape a query parameter before rendering it on the page, creating a reflected cross‑site scripting vulnerability. An attacker can embed arbitrary JavaScript in the vulnerable parameter and cause it to execute in the browser of any user who views the crafted URL. Because the target user may be a site administrator, the flaw can be used to hijack an admin session, steal privileged data, or perform other malicious actions within that user’s authority.

WordPress sites that use the Broken Link Manager plugin version 0.6.5 or earlier are affected. The issue applies to any installation of the plugin that has not been upgraded beyond this release.

The CVSS score of 7.1 indicates high severity for this reflected XSS. The EPSS score of less than 1 percent suggests the vulnerability is currently unlikely to be widely exploited, and it is not listed in the CISA KEV catalog. Exploitation requires an attacker to craft a malicious link that includes the unsanitized parameter and entice a high‑privilege user, such as an administrator, to visit it. If the user’s session is compromised, the attacker can gain temporary high‑level access to the site. The attack surface is limited to users who click the crafted URL, but the potential impact for privileged accounts is significant.