PLUGIN SECURITY
Is Broken Link Checker safe?
Broken Link Checker helps you catch broken links & images fast, before they hurt your SEO or UX. Scan and bulk-fix issues from one easy dashboard.
What this plugin does
- Slug:
broken-link-checker - Author: WPMU DEV - Your All-in-One WordPress Platform
- 500000+ active installs
- 76/100 rating (603 reviews on wordpress.org)
- 23795112 all-time downloads
- On WordPress.org since 2007-10-08
broken imagesbroken linksexternal linkinternal linklinks
Maintenance status
- Latest known version: 2.4.11
- Last updated: 2026-08-24 9:59am GMT
- Tested up to WordPress: 7.1
- Requires PHP: 7.4+
- Max supported PHP (analyzed): <8.0
Known vulnerabilities
13 known CVEs on file for Broken Link Checker.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-18937 | Broken Link Checker [broken-link-checker] < 2.4.12 | Improper Control of Generation of Code ('Code Injection') | Unknown | < 2.4.12 | 2.4.12 | 2026-08-19 | ⚠ update needed |
| CVE-2026-39466 | Broken Link Checker [broken-link-checker] < 2.4.8 | — | High 7.6 | < 2.4.8 | 2.4.8 | 2026-03-26 | ✓ fixed in latest |
| CVE-2024-10903 | Broken Link Checker [broken-link-checker] < 2.4.2 | Server-Side Request Forgery (SSRF) | Medium 4.7 | < 2.4.2 | 2.4.2 | 2024-12-05 | ✓ fixed in latest |
| CVE-2024-8981 | Broken Link Checker [broken-link-checker] < 2.4.1 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | High 7.1 | < 2.4.1 | 2.4.1 | 2024-09-30 | ✓ fixed in latest |
| CVE-2024-25592 | Broken Link Checker [broken-link-checker] < 2.2.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.9 | < 2.2.4 | 2.2.4 | 2024-02-12 | ✓ fixed in latest |
| — | Broken Link Checker [broken-link-checker] < 1.10.2 | — | Unknown | < 1.10.2 | 1.10.2 | 2023-12-04 | ✓ fixed in latest |
| — | Broken Link Checker [broken-link-checker] < 1.9.2 | — | Unknown | < 1.9.2 | 1.9.2 | 2023-08-01 | ✓ fixed in latest |
| — | Broken Link Checker [broken-link-checker] < 1.10.6 | — | Unknown | < 1.10.6 | 1.10.6 | 2023-04-20 | ✓ fixed in latest |
+ 20 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2022-3922 | Broken Link Checker [broken-link-checker] < 1.11.20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 1.11.20 | 1.11.20 | 2022-11-11 | ✓ fixed in latest |
| CVE-2022-2438 | Broken Link Checker [broken-link-checker] < 1.11.17 | Deserialization of Untrusted Data | High 7.2 | < 1.11.17 | 1.11.17 | 2022-07-18 | ✓ fixed in latest |
| CVE-2019-16521 | Broken Link Checker [broken-link-checker] < 1.11.9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.11.9 | 1.11.9 | 2019-10-15 | ✓ fixed in latest |
| CVE-2019-17207, CVE-2019-16521 | Broken Link Checker [broken-link-checker] < 1.11.9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.11.9 | 1.11.9 | 2019-10-14 | ✓ fixed in latest |
| CVE-2015-5057 | Broken Link Checker [broken-link-checker] < 1.10.9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.10.9 | 1.10.9 | 2015-06-29 | ✓ fixed in latest |
| — | Broken Link Checker [broken-link-checker] < 1.10.6 | — | Unknown | < 1.10.6 | 1.10.6 | 2015-04-20 | ✓ fixed in latest |
| CVE-2015-10098 | Broken Link Checker [broken-link-checker] < 1.10.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.10.6 | 1.10.6 | 2015-04-20 | ✓ fixed in latest |
| CVE-2014-125105 | Broken Link Checker [broken-link-checker] < 1.10.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.10.2 | 1.10.2 | 2014-12-05 | ✓ fixed in latest |
| — | Broken Link Checker [broken-link-checker] < 1.10.2 | — | Unknown | < 1.10.2 | 1.10.2 | 2014-12-04 | ✓ fixed in latest |
| — | Broken Link Checker [broken-link-checker] < 1.9.2 | — | Unknown | < 1.9.2 | 1.9.2 | 2014-08-01 | ✓ fixed in latest |
| — | Broken Link Checker [broken-link-checker] < 2.4.5 | Missing Authorization | Medium 4.3 | < 2.4.5 | 2.4.5 | 0000-00-00 | ✓ fixed in latest |
| — | Broken Link Checker [broken-link-checker] < 1.10.6 | — | Unknown | < 1.10.6 | 1.10.6 | — | ✓ fixed in latest |
| — | Broken Link Checker [broken-link-checker] < 1.10.3 | — | Unknown | < 1.10.3 | 1.10.3 | — | ✓ fixed in latest |
| — | Broken Link Checker [broken-link-checker] < 1.10.2 | — | Unknown | < 1.10.2 | 1.10.2 | — | ✓ fixed in latest |
| — | Broken Link Checker 1.9.1 - Bulk Action Form URL H&ling XSS | — | Unknown | < 1.9.2 | 1.9.2 | — | ✓ fixed in latest |
| — | Broken Link Checker 1.9.1 - Sort Direction Query Argument H&ling XSS | — | Unknown | < 1.9.2 | 1.9.2 | — | ✓ fixed in latest |
| — | Broken Link Checker 1.10.1 - Authenticated Stored XSS | — | Unknown | < 1.10.2 | 1.10.2 | — | ✓ fixed in latest |
| — | Broken Link Checker <= 1.10.5 - CSRF/XSS | — | Unknown | < 1.10.6 | 1.10.6 | — | ✓ fixed in latest |
| — | Broken Link Checker <= 1.10.2 - Stored XSS | — | Unknown | < 1.10.3 | 1.10.3 | — | ✓ fixed in latest |
| CVE-2025-4047 | Broken Link Checker < 2.4.5 - Subscriber+ Plugin Status Dashboard View | — | Unknown | < 2.4.5 | 2.4.5 | — | ✓ fixed in latest |
How to fix it
Keep Broken Link Checker updated — 2.4.11 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Broken Link Checker by AIOSEO – Find & Fix Broken Internal, External & Video Links — 300000+ active installs — 78/100 (83) — max PHP 8.4
- All 404 Redirect to Homepage — 200000+ active installs — 82/100 (96) — max PHP 8.4
- 404 Solution — 10000+ active installs — 98/100 (44) — max PHP 8.4
- Link Checker — 4000+ active installs — 64/100 (30)
- Internet Archive Wayback Machine Link Fixer — 1000+ active installs — 76/100 (8)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.