Skip to content
Noroxi

Broken Link Checker

broken-link-checker · plugin

Known security vulnerabilities for Broken Link Checker. Find out in seconds which version runs on your site with WP Lens.

10 known vulnerabilities

4 exploitable without logging in · latest Sep 2, 2026

Listed on wordpress.org · latest 2.4.14.1 · last updated Aug 31, 2026 · 500K+ installs

wordpress.org status checked on Oct 4, 2026

Vulnerabilities

  • CVE-2026-39466high privilege≤ 2.4.7

    WordPress Broken Link Checker plugin <= 2.4.7 - SQL Injection vulnerability

    High 7.6

  • CVE-2026-75528unauthenticated≤ 2.4.13

    Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log

    High 7.2

  • CVE-2022-2438admin≤ 1.11.16

    Broken Link Checker <= 1.11.16 - Authenticated (Admin+) PHAR Deserialization

    High 7.2

  • CVE-2024-8981unauthenticated · needs a click≤ 2.4.0

    Broken Link Checker <= 2.4.0 - Reflected Cross-Site Scripting

    High 7.1

  • CVE-2019-16521unauthenticated · needs a click

    The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encodi

    Medium 6.1

  • CVE-2015-5057unauthenticated · needs a click

    Cross-site scripting (XSS) vulnerability exists in the Wordpress admin panel when the Broken Link Checker plugin before 1.10.9 is installed.

    Medium 6.1

  • CVE-2026-84772editor+≤ 2.4.14

    WordPress Broken Link Checker plugin <= 2.4.14 - Server Side Request Forgery (SSRF) vulnerability

    Medium 5.5

  • CVE-2019-17207login required

    A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11

    Medium 5.4

  • CVE-2024-25592high privilege≤ 2.2.3

    WordPress Broken Link Checker plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerability

    Medium 4.8

  • CVE-2025-4047subscriber+≤ 2.4.4

    Broken Link Checker <= 2.4.4 - Missing Autorization to Authenticated (Subscriber+) Plugin Status Dashboard View

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory