Broken Link Checker Vulnerabilities

The Broken Link Checker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to 2.4.12. This is due to insufficient validation of user supplied input before it is executed. This makes it possible for unauthenticated attackers to execute arbitrary code on the server.

CVSS:

9.8

Affected:

up to 2.4.12

Fixed in:

2.4.12

Disclosed:

Aug 21, 2026

CVE-2026-18937 on NVD →

The Broken Link Checker plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.4.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and a...

CVSS:

4.9

Affected:

up to 2.4.7

Fixed in:

2.4.8

Disclosed:

Mar 26, 2026

CVE-2026-39466 on NVD →

The Broken Link Checker plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the ajax_full_status and ajax_dashboard_status functions in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVSS:

4.3

Affected:

up to 2.4.4

Fixed in:

2.4.5

Disclosed:

Jun 2, 2025

CVE-2025-4047 on NVD →

[en] The Broken Link Checker WordPress plugin before 2.4.2 does not validate a the link URLs before making a request to them, which could allow admin users to perform SSRF attack, for example on a multisite installation.

Affected:

up to 2.4.2

Fixed in:

2.4.2

Disclosed:

Dec 26, 2024

CVE-2024-10903 on NVD →

The Broken Link Checker plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application which can...

CVSS:

5.5

Affected:

up to 2.4.1

Fixed in:

2.4.2

Disclosed:

Dec 5, 2024

CVE-2024-10903 on NVD →

[en] The Broken Link Checker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg in /app/admin-notices/features/class-view.php without appropriate escaping on the URL in all versions up to, and including, 2.4.0. This makes it possible for unauthenticated attackers to inj...

Affected:

up to 2.4.1

Fixed in:

2.4.1

Disclosed:

Oct 1, 2024

CVE-2024-8981 on NVD →

The Broken Link Checker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg in /app/admin-notices/features/class-view.php without appropriate escaping on the URL in all versions up to, and including, 2.4.0. This makes it possible for unauthenticated attackers to inject a...

CVSS:

7.1

Affected:

up to 2.4.0

Fixed in:

2.4.1

Disclosed:

Sep 30, 2024

CVE-2024-8981 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Broken Link Checker allows Stored XSS.This issue affects Broken Link Checker: from n/a through 2.2.3.

Affected:

up to 2.2.4

Fixed in:

2.2.4

Disclosed:

Mar 15, 2024

CVE-2024-25592 on NVD →

The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inje...

CVSS:

4.4

Affected:

up to 2.2.3

Fixed in:

2.2.4

Disclosed:

Feb 12, 2024

CVE-2024-25592 on NVD →

Update the plugin. An unknown person discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Broken Link Checker Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when gue...

Affected:

up to 1.10.2

Fixed in:

1.10.2

Disclosed:

Dec 4, 2023

Update the plugin. An unknown person discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Broken Link Checker Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when gue...

Affected:

up to 1.9.2

Fixed in:

1.9.2

Disclosed:

Aug 1, 2023

[en] A vulnerability was found in Broken Link Checker Plugin up to 1.10.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function options_page of the file core/core.php of the component Settings Page. The manipulation of the argument exclusion_list/blc_custom_fields leads to cr...

Affected:

up to 1.10.2

Fixed in:

1.10.2

Disclosed:

Jun 5, 2023

CVE-2014-125105 on NVD →

Update the plugin. An unknown person discovered and reported this Multiple Vulnerabilities vulnerability in WordPress Broken Link Checker Plugin. Multiple vulnerabilities were found. Due to the large number of vulnerabilities, this has been grouped in this category. This vulnerability has been fixed in version 1.10.6.

Affected:

up to 1.10.6

Fixed in:

1.10.6

Disclosed:

Apr 20, 2023

[en] A vulnerability was found in Broken Link Checker Plugin up to 1.10.5 on WordPress. It has been rated as problematic. Affected by this issue is the function print_module_list/show_warnings_section_notice/status_text/ui_get_action_links. The manipulation leads to cross site scripting. The attack may be launched remo...

Affected:

up to 1.10.6

Fixed in:

1.10.6

Disclosed:

Apr 8, 2023

CVE-2015-10098 on NVD →

[en] The Broken Link Checker WordPress plugin before 1.11.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected:

up to 1.11.20

Fixed in:

1.11.20

Disclosed:

Dec 28, 2022

CVE-2022-3922 on NVD →

The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘youtube_api_key’ parameter in versions up to, and including, 1.11.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

CVSS:

5.5

Affected:

up to 1.11.19

Fixed in:

1.11.20

Disclosed:

Nov 11, 2022

CVE-2022-3922 on NVD →

[en] The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to, and including 1.11.16. This makes it possible for authenticated attackers with administrative privileges and above to call files using a PHAR wrapper that will deserialize t...

Affected:

up to 1.11.17

Fixed in:

1.11.17

Disclosed:

Sep 6, 2022

CVE-2022-2438 on NVD →

The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to, and including 1.11.16. This makes it possible for authenticated attackers with administrative privileges and above to call files using a PHAR wrapper that will deserialize the da...

CVSS:

7.2

Affected:

up to 1.11.16

Fixed in:

1.11.17

Disclosed:

Jul 18, 2022

CVE-2022-2438 on NVD →

[en] A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the wp-admin/tools.php?page=view-broken-links s_filter...

Affected:

up to 1.11.9

Fixed in:

1.11.9

Disclosed:

Oct 18, 2019

CVE-2019-17207 on NVD →

[en] The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encoding and insertion of an HTTP GET parameter into HTML. The filter function on the page listing all detected broken links can be exploited by providing an XSS payload in the s_fi...

Affected:

up to 1.11.9

Fixed in:

1.11.9

Disclosed:

Oct 16, 2019

CVE-2019-16521 on NVD →

The Broken Link Checker plugin through 1.11.8 for WordPress is susceptible to Reflected XSS due to improper encoding and insertion of an HTTP GET parameter into HTML. The filter function on the page listing all detected broken links can be exploited by providing an XSS payload in the s_filter GET parameter in a filter_...

CVSS:

6.1

Affected:

up to 1.11.9

Fixed in:

1.11.9

Disclosed:

Oct 15, 2019

CVE-2019-16521 on NVD →

A reflected XSS vulnerability was found in includes/admin/table-printer.php in the Broken Link Checker plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the wp-admin/tools.php?page=view-broken-links s_filter parameter in a search action.

CVSS:

5.4

Affected:

up to 1.11.9

Fixed in:

1.11.9

Disclosed:

Oct 14, 2019

CVE-2019-17207 on NVD →

[en] Cross-site scripting (XSS) vulnerability exists in the Wordpress admin panel when the Broken Link Checker plugin before 1.10.9 is installed.

Affected:

up to 1.10.9

Fixed in:

1.10.9

Disclosed:

Aug 18, 2017

CVE-2015-5057 on NVD →

Cross-site scripting (XSS) vulnerability exists in the Wordpress admin panel when the Broken Link Checker plugin before 1.10.9 is installed.

CVSS:

6.1

Affected:

up to 1.10.9

Fixed in:

1.10.9

Disclosed:

Jun 29, 2015

CVE-2015-5057 on NVD →

The Broken Link Checker plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 1.10.5 due to insufficient input sanitization and output escaping and the use of add_query_arg/remove_query_arg. This makes it possible for attackers to inject arbitrary web scripts that execute in a vic...

CVSS:

5.3

Affected:

up to 1.10.6

Fixed in:

1.10.6

Disclosed:

Apr 20, 2015

CVE-2015-10098 on NVD →

The Broken Link Checker plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 1.10.5 due to insufficient input sanitization and output escaping and the use of add_query_arg/remove_query_arg. This makes it possible for attackers to inject arbitrary web scripts that execute in a vic...

Affected:

up to 1.10.6

Fixed in:

1.10.6

Disclosed:

Apr 20, 2015

This plugin is prone to a cross site scripting and cross site request forgery vulnerability. Update the plugin.

Affected:

up to 1.10.6

Fixed in:

1.10.6

Disclosed:

Apr 20, 2015

The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘exclusion_list’ parameter in versions up to, and including, 1.10.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages th...

CVSS:

5.5

Affected:

up to 1.10.2

Fixed in:

1.10.2

Disclosed:

Dec 5, 2014

CVE-2014-125105 on NVD →

The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘exclusion_list’ parameter in versions up to, and including, 1.10.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages th...

Affected:

up to 1.10.2

Fixed in:

1.10.2

Disclosed:

Dec 5, 2014

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.

Affected:

up to 1.10.2

Fixed in:

1.10.2

Disclosed:

Dec 4, 2014

This plugin is prone to a cross site scripting vulnerability. Update the plugin.

Affected:

up to 1.9.2

Fixed in:

1.9.2

Disclosed:

Aug 1, 2014

Affected:

up to 1.9.2

Fixed in:

1.9.2

Affected:

up to 1.9.2

Fixed in:

1.9.2

Affected:

up to 1.10.2

Fixed in:

1.10.2

Broken Link Checker is vulnerable to stored XSS (again). The plugin don’t check the links on their validity. Very bad: JavaScript code is a valid link. Example: <a href="javascript:alert(1)">Link</a>. Malicious JavaScript can be injected by any post author. Screenshots: http://imgur.com/...

Affected:

up to 1.10.3

Fixed in:

1.10.3

The Broken Link Checker WordPress plugin was affected by a CSRF/XSS security vulnerability.

Affected:

up to 1.10.6

Fixed in:

1.10.6

Affected:

up to 2.4.5

Fixed in:

2.4.5

CVE-2025-4047 on NVD →