URL Shortify CVE-2026-73362

Exploitation requires that the target WordPress site has the URL Shortify plugin installed and active in a version at or below 2.5.0. The CVSS vector confirms no authentication is required from the attacker (PR:N), but the victim must interact with a crafted link or page (UI:R) - meaning the attacker cannot exploit this passively and must deliver the payload through phishing, a compromised referral site, or similar social engineering. There is no indication of a non-default configuration requirement; the vulnerability appears to exist in standard plugin operation. The primary limiting factor is the mandatory user interaction step, which constrains opportunistic or automated mass exploitation.

The CVSS 7.1 score reflects a meaningful but not maximum risk profile: the attack is network-reachable with no authentication required (AV:N/PR:N/AC:L), but exploitation depends on social engineering a victim into clicking a crafted link (UI:R), which introduces a friction point. EPSS data is absent from available intelligence, so exploitation probability cannot be quantified statistically. The vulnerability is not listed in the CISA KEV catalog and no POC code has been identified, so real-world exploitation is plausible but not confirmed. The triple-low impact rating (C:L/I:L/A:L) somewhat understates the practical risk of XSS against WordPress administrators, as script execution in an admin session can lead to full site compromise via plugin installation or credential exfiltration - even a mid-sized municipal IT team in swidnica managing a public-facing WordPress site should treat this as an urgent patch given the zero-authentication-required delivery. The key limiting factor is the required user interaction, which reduces the likelihood of opportunistic mass exploitation compared to a fully unauthenticated stored XSS.

An attacker crafts a malicious URL containing an injected JavaScript payload targeting a parameter processed by URL Shortify, then delivers that link to a WordPress administrator via email or a compromised page. When the administrator's browser loads the crafted URL while authenticated, the injected script executes in their session, potentially exfiltrating the session cookie or issuing authenticated API requests to install a backdoor plugin. No public POC has been identified at time of analysis, but the low attack complexity makes independent derivation straightforward.