CveMateVulnerability intelligence

Kaizencoders vulnerabilities

24 vulnerabilities

Known vulnerabilities in Kaizencoders products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 9 products.

Products

9

Short Url8 vulnerabilities
Url Shortify7 vulnerabilities
URL Shortify – Simple And Easy URL Shortener3 vulnerabilities
Attachments Handler1 vulnerabilities
Automatic Ban IP1 vulnerabilities
Enable Latex1 vulnerabilities
Table Of Content1 vulnerabilities
Traffic Manager1 vulnerabilities
Update Urls – Quick And Easy Way To Search Old Links And Replace Them With New Links In Wordpress1 vulnerabilities

CVE-2021-24749kaizencodersurl_shortify+24y ago29-11-2021 08:25

The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, which could allow attackers to make a logged in admin delete arbitrary link and group via a CSRF attack.CVE-2025-58860kaizencodersenable latex+11y ago05-09-2025 13:45

Cross-Site Request Forgery (CSRF) vulnerability in KaizenCoders Enable Latex enable-latex allows Stored XSS.This issue affects Enable Latex: from n/a through <= 1.2.16.CVE-2025-58857kaizencoderstable of content+11y ago05-09-2025 13:45

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaizenCoders Table of content content-table allows Stored XSS.This issue affects Table of content: from n/a through <= 1.5.3.1.CVE-2025-32134kaizencodersurl_shortify+11y ago04-04-2025 15:58

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaizenCoders URL Shortify url-shortify allows Stored XSS.This issue affects URL Shortify: from n/a through <= 1.10.5.1.CVE-2025-32632kaizencodersautomatic ban ip+11y ago11-04-2025 08:43

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaizenCoders Automatic Ban IP automatic-ban-ip allows Reflected XSS.This issue affects Automatic Ban IP: from n/a through <= 1.0.7.CVE-2025-12581kaizencodersattachments handler+110mo ago20-12-2025 03:20

The Attachments Handler plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.CVE-2022-49745starpluginseasy_age_verify+12392y ago16-10-2024 06:43

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.CVE-2022-46860kaizencodersshort_url+12y ago06-11-2023 07:53

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in KaizenCoders Short URL allows SQL Injection.This issue affects Short URL: from n/a through 1.6.4.CVE-2024-13362100pluginsopen_user_map+2625mo ago01-05-2026 05:29

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.CVE-2024-7485kaizencoderstraffic manager+12y ago06-08-2024 01:49

The Traffic Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page' parameter in the 'UserWebStat' AJAX function in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-32138kaizencodersshort_url+12y ago15-04-2024 07:05

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaizenCoders Short URL allows Reflected XSS.This issue affects Short URL: from n/a through 1.6.8.CVE-2026-73362kaizencodersurl_shortify+12mo ago18-08-2026 14:00

Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.CVE-2026-1277kaizencodersurl shortify – simple and easy url shortener+18mo ago18-02-2026 04:35

The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link.CVE-2026-25392kaizencodersupdate urls – quick and easy way to search old links and replace them with new links in wordpress+18mo ago19-02-2026 08:27

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in KaizenCoders Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress update-urls allows Phishing.This issue affects Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress: from n/a through <= 1.4.3.CVE-2026-25385kaizencodersurl_shortify+18mo ago19-02-2026 08:27

Server-Side Request Forgery (SSRF) vulnerability in KaizenCoders URL Shortify url-shortify allows Server Side Request Forgery.This issue affects URL Shortify: from n/a through <= 1.12.3.CVE-2023-2921kaizencodersshort_url+21y ago06-06-2025 06:00

The Short URL WordPress plugin through 1.6.8 does not properly sanitise and escape a parameter before using it in SQL statement, leading to a SQL injection exploitable by users with relatively low privilege on the site, like subscribers.CVE-2023-1604kaizencodersshort_url+12y ago17-08-2024 07:34

The Short URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.8. This is due to missing or incorrect nonce validation on the configuration_page function. This makes it possible for unauthenticated attackers to add and import redirects, including comments containing cross-site scripting as detailed in CVE-2023-1602, granted they can trick a site administrator into performing an action such as clicking on a link.CVE-2023-1602kaizencodersshort_url+13y ago29-06-2023 01:56

The Short URL plugin for WordPress is vulnerable to stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping in versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2023-47225kaizencodersshort_url+11y ago02-01-2025 12:00

Missing Authorization vulnerability in KaizenCoders Short URL shorten-url allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Short URL: from n/a through <= 1.6.8.CVE-2023-4294kaizencodersurl_shortify+23y ago11-09-2023 19:46

The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short link.