cleantalk
Vulnerabilities and Security Researches

URL Shortify – Simple, Powerful and Easy URL Shortener Plugin For WordPress, CVE-2026-1277

CVE, Research URL

CVE-2026-1277

Home page URL

Security reports for URL Shortify – Simple, Powerful and Easy URL Shortener Plugin For WordPress

Application

URL Shortify – Simple, Powerful and Easy URL Shortener Plugin For WordPress

Published on
Feb 18, 2026
Research Description
The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link.
Affected versions
max 1.12.2.
Status
vulnerable
Previous vulnerability researches
Stacks Mobile App Builder – The most powerful Mobile Applications Drag and Drop builder (CVE-2024-50477) , Oct 29, 2024
Stacks Mobile App Builder – The most powerful Mobile Applications Drag and Drop builder (CVE-2024-50528) , Nov 03, 2024
Stacks Mobile App Builder – The most powerful Mobile Applications Drag and Drop builder (CVE-2024-50527) , Nov 03, 2024
App Builder – Create Native Android & iOS Apps On The Flight (CVE-2024-9302) , Oct 26, 2024
App Builder – Create Native Android & iOS Apps On The Flight (CVE-2024-7651) , Aug 22, 2024
New vulnerability
User Language Switch (CVE-2026-0745) , Apr 15, 2026
User Language Switch (CVE-2026-0735) , Apr 15, 2026
Campaign Monitor for WordPress (CVE-2026-0674) , Apr 15, 2026
WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into WordPress (CVE-2026-1941) , Apr 15, 2026
Microtango (CVE-2026-1821) , Apr 15, 2026