Kaizencoders Url Shortify vulnerabilities

7 vulnerabilities

Known vulnerabilities in Kaizencoders Url Shortify, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

4.3CVE-2021-24749kaizencodersurl_shortify+2
EPSS score
0.45%
The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, which could allow attackers to make a logged in admin delete arbitrary link and group via a CSRF attack.5.9CVE-2025-32134kaizencodersurl_shortify+1
EPSS score
0.41%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaizenCoders URL Shortify url-shortify allows Stored XSS.This issue affects URL Shortify: from n/a through <= 1.10.5.1.7.2CVE-2026-73362kaizencodersurl_shortify+1
EPSS score
0.25%
Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.6.4CVE-2026-25385kaizencodersurl_shortify+1
EPSS score
0.27%
Server-Side Request Forgery (SSRF) vulnerability in KaizenCoders URL Shortify url-shortify allows Server Side Request Forgery.This issue affects URL Shortify: from n/a through <= 1.12.3.7.2CVE-2023-4294kaizencodersurl_shortify+2
EPSS score
0.82%
The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short link.4.8CVE-2023-5605kaizencodersurl_shortify+2
EPSS score
0.41%
The URL Shortify WordPress plugin before 1.7.9.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)4.8CVE-2023-3129kaizencodersurl_shortify+2
EPSS score
0.56%
The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)