Arbitrary Shortcode Execution in Broken Link Checker Plugin for WordPress

CVE-2026-96562

What is CVE-2026-96562?

The Broken Link Checker plugin for WordPress is affected by a vulnerability allowing arbitrary shortcode execution in all versions up to and including 2.4.14.1. This issue arises from the plugin's failure to adequately validate input before executing the do_shortcode function. Attackers can exploit this vulnerability by submitting a comment containing a malicious shortcode within an href or src attribute. If this comment is approved through the normal moderation process, the shortcode is automatically executed via WP-Cron, enabling unauthorized code execution without further interaction from the attacker.

References