Is broken-link-checker (WordPress plugin) vulnerable?

WordPress broken-link-checker has 8 known advisories in the phpwarden feed. Feed 2026.10.29.4, updated 2026-10-29.

8advisories
0critical
0on CISA KEV
4no fix recorded
CVETitleSeverityCVSSAffectedFixed in
CVE-2022-2438The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up tohigh7.2<1.11.171.11.17
CVE-2019-17207A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11medium5.4<=1.11.8–
CVE-2015-5057Cross-site scripting (XSS) vulnerability exists in the Wordpress admin panel when the Broken Link Checker plugin before 1.10.9 is installed.medium6.1<=1.10.8–
CVE-2019-16521The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encodimedium6.1<=1.11.8–
CVE-2015-10098A vulnerability was found in Broken Link Checker Plugin up to 1.10.5 on WordPress. It has been rated as problematic. Affected by this issue low3.5<1.10.61.10.6
CVE-2014-125105A vulnerability was found in Broken Link Checker Plugin up to 1.10.1 on WordPress. It has been declared as problematic. Affected by this vullow2.4<=1.10.1–
CVE-2022-3922The Broken Link Checker WordPress plugin before 1.11.20 does not sanitise and escape some of its settings, which could allow high privilege medium4.8<1.11.201.11.20
CVE-2024-10903The Broken Link Checker WordPress plugin before 2.4.2 does not validate a the link URLs before making a request to them, which could allow amedium4.7<2.4.22.4.2

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs   How findings are ranked
A version is vulnerable when it falls inside an affected range and below the fixed version. phpwarden applies these ranges to the exact versions in your lockfile or install, so you only see what applies to you.