6.1
Medium
CVE-2023-4294 The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing…
Description
The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short link.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| URL Shortify 1.7 | earliest → < 1.7.6 | 1.7.6 |
Other CVEs of URL Shortify
The 5 CVEs of URL Shortify →
CVE-2025-13355
The URL Shortify WordPress plugin before 1.11.4 does not sanitise and escape a parameter before outputting it back in…
7.1
High
CVE-2025-12684
The URL Shortify WordPress plugin before 1.11.3 does not sanitize and escape a parameter before outputting it back in…
7.1
High
CVE-2023-5605
The URL Shortify WordPress plugin before 1.7.9.1 does not sanitise and escape some of its settings, which could allow…
Not rated
CVE-2023-3129
The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high…
Not rated