CVE-2026-1277 — URL Shortify <= 1.12.1 - Unauthenticated Open Redirect via 'redirect_to' Parameter
The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter i…
Published: 2026-02-18 · CVSS: 4.7 · CVSS 3.1
The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7