CVE-2026-96562

Name of the Vulnerable Software and Affected Versions Broken Link Checker versions prior to 2.4.15

Description The Broken Link Checker plugin for WordPress allows unauthenticated attackers to execute arbitrary shortcodes. This occurs because the software fails to properly validate a value before executing the do shortcode function. An attacker can exploit this by submitting a comment containing a shortcode payload within an href or src attribute. Once the comment is approved through the standard moderation workflow, the shortcode is automatically executed via WP-Cron.

Recommendations Update Broken Link Checker to a version newer than 2.4.14.1.