EUVD-2026-60786
GHSA-65hf-9c2p-ww49
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
XSS via network with no auth and user-interaction required; scope changes to browser context; no availability impact from script injection.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.
AnalysisAI
Unauthenticated Cross-Site Scripting in the URL Shortify WordPress plugin (versions <= 2.5.0) allows remote attackers to inject malicious scripts into pages viewed by authenticated victims, including site administrators. With a Changed scope (S:C), successful exploitation extends the attack surface beyond the plugin itself into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions within the WordPress dashboard. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress site has the URL Shortify plugin installed and active in a version at or below 2.5.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 score reflects a meaningful but not maximum risk profile: the attack is network-reachable with no authentication required (AV:N/PR:N/AC:L), but exploitation depends on social engineering a victim into clicking a crafted link (UI:R), which introduces a friction point. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious URL containing an injected JavaScript payload targeting a parameter processed by URL Shortify, then delivers that link to a WordPress administrator via email or a compromised page. When the administrator's browser loads the crafted URL while authenticated, the injected script executes in their session, potentially exfiltrating the session cookie or issuing authenticated API requests to install a backdoor plugin. … |
| Remediation | Update the URL Shortify plugin to a version above 2.5.0 as soon as a patched release is published by KaizenCoders; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/url-shortify/vulnerability/wordpress-url-shortify-plugin-2-5-0-cross-site-scripting-xss-vulnerability for confirmed fix version details, as an exact patched version number was not independently confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: immediately disable and remove all installations of URL Shortify versions 2.5.0 or earlier from production and staging environments, then audit web server and WordPress logs for exploitation attempts targeting the plugin. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Url Shortify
View allThe URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing a
The URL Shortify WordPress plugin before 1.7.9.1 does not sanitise and escape some of its settings, which could allow hi
The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high
The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, whi
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today