Live › vulnerability › CVE-2026-96562
Go to dashboardThe Broken Link Checker plugin for WordPress, in all versions up to and including 2.4.14.1, passes unvalidated values to do_shortcode. An unauthenticated attacker can submit a comment with a crafted shortcode in an href or src attribute, and once a moderator approves it, WP-Cron runs the shortcode.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Broken Link Checker plugin at version 2.4.14.1 or earlier are exposed, as long as a comment can reach moderation and be approved. Sites without the plugin, or running a later version, are not affected.
No product ranges from the sources yet.
2.4.14.1 or lower in the WordPress plugins list2.4.14.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires that a submitted comment containing the shortcode payload in an href or src attribute is approved through the site's normal comment moderation workflow; once approved, the shortcode is executed automatically via WP-Cron without any further attacker interaction.
This page as .md · .json · in your agent: get_signal("CVE-2026-96562")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.