ManageWP provides WordPress site-management and maintenance tools, with documented vulnerability exposure concentrating in its Broken Link Checker plugin and rooted in web-application weakness classes such as cross-site scripting, SQL injection, server-side request forgery, and unsafe deserialization of untrusted data. These vulnerability patterns reflect the plugin's broad integration into WordPress ecosystems and its interaction with user-supplied content and external resources, creating a meaningful tendency toward critical-severity outcomes. Defenders deploying this plugin should prioritize updates and restrict its administrative access; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Managewp over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-23737CRITICAL Unauth. SQL Injection (SQLi) vulnerability in MainWP MainWP Broken Links Checker Extension plugin <= 4.0 versions. | Oct 12, 2023 | 9.8 | 27 | NO | NO |
CVE-2014-125105MEDIUM A vulnerability was found in Broken Link Checker Plugin up to 1.10.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function options_page | Jun 5, 2023 | 6.1 | 20 | NO | NO |
CVE-2019-17207MEDIUM A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11.8 for WordPress. This allows unauthoriz | Oct 18, 2019 | 5.4 | 20 | NO | NO |
CVE-2019-16521MEDIUM The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encoding and insertion of an HTTP GET paramete | Oct 16, 2019 | 6.1 | 20 | NO | NO |
CVE-2022-3922MEDIUM The Broken Link Checker WordPress plugin before 1.11.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cr | Dec 28, 2022 | 4.8 | 19 | NO | NO |
CVE-2022-2438HIGH The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to, and including 1.11.16. This makes it p | Sep 6, 2022 | 7.2 | 19 | NO | NO |
CVE-2024-10903MEDIUM The Broken Link Checker WordPress plugin before 2.4.2 does not validate a the link URLs before making a request to them, which could allow admin users to perform SSRF attack, for e | Dec 26, 2024 | 4.7 | 16 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Managewp.
Media articles that mention a CVE ID that affects a product developed by Managewp — matched by CVE ID, not by vendor name.