Skip to content
Sign in
4.7 Medium

CVE-2026-1277 The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to…

Description

The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link.

Affected products and versions

Product Affected versions Fixed in
URL Shortify – Simple and Easy URL Shortener 1.12 earliest → 1.12.1 No fix stated

Other CVEs of URL Shortify – Simple and Easy URL Shortener

The 3 CVEs of URL Shortify – Simple and Easy URL Shortener →
CVE-2024-13362 Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in… 6.1 Medium CVE-2022-4974 The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request… 6.3 Medium
Track this CVE