CVE-2026-1277

Name of the Vulnerable Software and Affected Versions URL Shortify plugin for WordPress versions prior to 1.12.2

Description The URL Shortify plugin for WordPress is susceptible to an Open Redirect issue in all versions up to and including 1.12.1. This is due to inadequate validation of the redirect to parameter within the promotional dismissal handler. An unauthenticated attacker can exploit this to redirect users to potentially malicious websites using a specially crafted link. The vulnerable parameter is redirect to.

Recommendations Update the URL Shortify plugin to version 1.12.2 or later.