Unknown URL Shortify vulnerabilities

5 vulnerabilities

Known vulnerabilities in Unknown URL Shortify, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.1CVE-2025-13355unknownurl shortify+1
EPSS score
0.17%
The URL Shortify WordPress plugin before 1.11.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.7.1CVE-2025-12684unknownurl shortify+1
EPSS score
0.17%
The URL Shortify WordPress plugin before 1.11.3 does not sanitize and escape a parameter before outputting it back in the page, leading to a reflected cross site scripting, which could be used against high-privilege users such as admins.7.2CVE-2023-4294kaizencodersurl_shortify+2
EPSS score
0.82%
The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short link.4.8CVE-2023-5605kaizencodersurl_shortify+2
EPSS score
0.41%
The URL Shortify WordPress plugin before 1.7.9.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)4.8CVE-2023-3129kaizencodersurl_shortify+2
EPSS score
0.56%
The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)