Skip to content
Sign in
Not rated

CVE-2023-3129 The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high…

Description

The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected products and versions

Product Affected versions Fixed in
URL Shortify 1.7 earliest → < 1.7.0 1.7.0

Other CVEs of URL Shortify

The 5 CVEs of URL Shortify →
CVE-2025-13355 The URL Shortify WordPress plugin before 1.11.4 does not sanitise and escape a parameter before outputting it back in… 7.1 High CVE-2025-12684 The URL Shortify WordPress plugin before 1.11.3 does not sanitize and escape a parameter before outputting it back in… 7.1 High CVE-2023-5605 The URL Shortify WordPress plugin before 1.7.9.1 does not sanitise and escape some of its settings, which could allow… Not rated CVE-2023-4294 The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing… 6.1 Medium
Track this CVE