CVE-2026-96562mediumCWE-94

CVE-2026-96562: fallo de gravedad media en wpmudev Broken Link Checker

Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callback

Publicada el

Seguir esta CVE+ Monitorear Broken Link Checker

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 0.3%
The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires that a submitted comment containing the shortcode payload in an href or src attribute is approved through the site's normal comment moderation workflow; once approved, the shortcode is executed automatically via WP-Cron without any further attacker interaction.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Productos afectados
wpmudev · Broken Link Checker
CVEs relacionadas — wpmudev Broken Link Checker

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-2438HIGHBroken Link Checker <= 1.11.16 - Authenticated (Admin+) PHAR DeserializationEPSS 1.8%CVE-2026-75528HIGHBroken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link LogEPSS 0.5%CVE-2024-8981HIGHBroken Link Checker <= 2.4.0 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2025-4047MEDIUMBroken Link Checker <= 2.4.4 - Missing Autorization to Authenticated (Subscriber+) Plugin Status Dashboard ViewEPSS 0.3%