CVE-2023-4294medium

CVE-2023-4294: medium-severity vulnerability in URL Shortify

URL Shortify < 1.7.6 - Unauthenticated Stored XSS via referer header

Published · Updated

Follow this CVE+ Monitor URL Shortify

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.8%
The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Unknown · URL Shortify
Related CVEs — URL Shortify

In the same product, most dangerous first.

CVE-2023-3129—URL Shortify < 1.7.0 - Admin+ Cross Site ScriptingEPSS 0.6%CVE-2023-5605—URL Shortify < 1.7.9.1 - Admin+ Stored XSSEPSS 0.5%CVE-2025-13355HIGHURL Shortify < 1.11.4 - Reflected XSSEPSS 0.2%CVE-2025-12684HIGHURL Shortify < 1.11.3 - Reflected XSSEPSS 0.2%