The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short link.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Url Shortify Plugin | — | Update url-shortify plugin to version 1.7.6, or a newer patched version | May 15, 2025 | Aug 21, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub