CVE-2026-1277: Kaizencoders Url Shortify – Simple And Easy Url Shortener

Medium severity, CVSS 4.7. EPSS: 0.6% chance of exploitation in the next 30 days.

The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link.

Affected products

• Kaizencoders Url Shortify – Simple And Easy Url Shortener: up to and including 1.12.1

Published 2026-02-18. Last modified 2026-06-17.