Broken Link Checker Security & Risk Analysis
wordpress.org/plugins/broken-link-checkerBroken Link Checker helps you catch broken links & images fast, before they hurt your SEO or UX. Scan and bulk-fix issues from one easy dashboard.
Is Broken Link Checker Safe to Use in 2026?
Generally Safe
Score 91/100Broken Link Checker has a strong security track record. Known vulnerabilities have been patched promptly.
The Broken Link Checker plugin, version 2.4.8, presents a mixed security posture. While the code analysis shows a commendable effort in using prepared statements for SQL queries (85%) and proper output escaping (82%), there are significant concerns. A total of 13 AJAX handlers are present, with 3 lacking authentication checks, creating a direct attack surface. The taint analysis, though limited in scope with only 10 flows analyzed, did reveal one flow with unsanitized paths, which could potentially lead to local file inclusion or similar vulnerabilities if exploited. The plugin's vulnerability history is particularly concerning, with 11 known CVEs, including 2 high-severity vulnerabilities related to Missing Authorization and SSRF. The fact that all previously identified CVEs are now patched is a positive sign, but the historical prevalence of these serious vulnerability types suggests a pattern of insecure coding practices that require ongoing vigilance and diligent updates. Overall, the plugin has some strengths in its data handling practices but is weakened by its exposed AJAX endpoints and historical security issues.
Key Concerns
- 3 unprotected AJAX handlers
- Flow with unsanitized paths
- 2 High severity CVEs historically
- 9 Medium severity CVEs historically
Broken Link Checker Security Vulnerabilities
CVEs by Year
Severity Breakdown
11 total CVEs
Broken Link Checker <= 2.4.4 - Missing Autorization to Authenticated (Subscriber+) Plugin Status Dashboard View
Broken Link Checker <= 2.4.1 - Authenticated (Admin+) Server-Side Request Forgery
Broken Link Checker <= 2.4.0 - Reflected Cross-Site Scripting
Broken Link Checker <= 2.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Broken Link Checker <= 1.11.19 - Authenticated (Administrator+) Stored Cross-Site Scripting
Broken Link Checker <= 1.11.16 - Authenticated (Admin+) PHAR Deserialization
Broken Link Checker <= 1.11.8 - Reflected Cross-Site Scripting
Broken Link Checker <= 1.11.8 - Reflected Cross-Site Scripting
Broken Link Checker <= 1.10.8 - Cross-Site Scripting
Broken Link Checker < 1.10.6 - Reflected Cross Site Scripting
Broken Link Checker < 1.10.2 - Authenticated (Admin+) Stored Cross-Site Scripting
Broken Link Checker Code Analysis
SQL Query Safety
Output Escaping
Data Flow Analysis
Broken Link Checker Attack Surface
AJAX Handlers 13
WordPress Hooks 115
Scheduled Events 4
Maintenance & Trust
Broken Link Checker Maintenance & Trust
Maintenance Signals
Community Trust
Broken Link Checker Alternatives
Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links
broken-link-checker-seo
Broken Link Checker by AIOSEO ensures all links on your website are working. Check your site for broken links and easily fix them to improve SEO.
External Links Overview
external-links-overview
Analyze, manage, and monitor all external links on your WordPress site. ---
LinkMaster – Link Management, SEO, Broken Links & Redirects
linkmaster
LinkMaster: Manage links with custom permalinks, SEO redirects, link cloaking, auto link injection and a broken link checker for WordPress.
anyLink
anylink
AnyLink is a Wordpress plugin which allow you to customise you external link like an internal one.
WhereUsed
where-used
Where used? This plugin helps you find usage of attachments, posts, links, blocks and more in all post types, taxonomy terms, post meta, user meta, an …
Broken Link Checker Developer Profile
9 plugins · 2.4M total installs
How We Detect Broken Link Checker
Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.
Asset Fingerprints
/wp-content/plugins/broken-link-checker/core/admin/css/blc-admin-styles.css/wp-content/plugins/broken-link-checker/core/admin/js/blc-admin-scripts.js/wp-content/plugins/broken-link-checker/core/ui/css/shared-ui.css/wp-content/plugins/broken-link-checker/core/ui/js/shared-ui.js/wp-content/plugins/broken-link-checker/core/admin/js/blc-admin-scripts.js/wp-content/plugins/broken-link-checker/core/ui/js/shared-ui.jsbroken-link-checker/core/admin/css/blc-admin-styles.css?ver=broken-link-checker/core/admin/js/blc-admin-scripts.js?ver=broken-link-checker/core/ui/css/shared-ui.css?ver=broken-link-checker/core/ui/js/shared-ui.js?ver=HTML / DOM Fingerprints
blc-plugin-admin-pageThis plugin is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 2 of the License, or
any later version.
Broken Link Checker is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with Broken Link Checker. If not, see https://www.gnu.org/licenses/gpl-2.0.html.Broken Link Checker is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 2 of the License, or
any later version.
Broken Link Checker is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with Broken Link Checker. If not, see https://www.gnu.org/licenses/gpl-2.0.html.data-blc-module-iddata-blc-module-contextWPMUDEV_BLC_VERSIONWPMUDEV_BLC_BASENAMEWPMUDEV_BLC_DIRWPMUDEV_BLC_URLWPMUDEV_BLC_ASSETS_URLWPMUDEV_BLC_SCIPTS_VERSION+2 more