PT-2025-51198 · WordPress · Url Shortify
CVE-2025-12684
·
Published
2025-12-15
·
Updated
2025-12-15
CVSS v3.1
7.1
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
URL Shortify WordPress plugin versions prior to 1.11.3
Description
The URL Shortify WordPress plugin does not properly sanitize and escape a parameter before displaying it, resulting in a reflected cross-site scripting issue. This could potentially be exploited against users with high privileges, such as administrators. The issue involves improper handling of user-supplied input, allowing malicious scripts to be injected into the webpage.
Recommendations
Update the URL Shortify WordPress plugin to version 1.11.3 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Url Shortify