CVE-2026-1277
—CVSS 3.1
4.7 medium
EPSS
<1%p46
Published
()
Modified
Description
The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link.
- Ecosystems
- WordPress
- Weakness
- CWE-601
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
In the news0 stories
No ingested article mentions this CVE yet.