Kaizencoders vulnerabilities
Published CVEs affecting Kaizencoders products: 6 record(s), with severity, exploitation and fixes.
URL Shortify – Simple and Easy URL Shortener 2URL Shortify 2Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress 1Attachments Handler 1
CVE-2026-73362
High · 7.1
CWE-79 Aug 18, 2026
WordPress URL Shortify plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.
CVE-2024-13362
Medium · 6.1
CWE-79 May 1, 2026
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVE-2026-25392
Medium · 4.7
CWE-601 Feb 19, 2026
WordPress Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress plugin <= 1.4.0 - Open Redirection vulnerability
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in KaizenCoders Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress update-urls allows Phishing.This issue affects Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress: from n/a through <= 1.4.3.
CVE-2026-25385
Medium · 5.5
CWE-918 Feb 19, 2026
WordPress URL Shortify plugin <= 1.12.3 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery (SSRF) vulnerability in KaizenCoders URL Shortify url-shortify allows Server Side Request Forgery.This issue affects URL Shortify: from n/a through <= 1.12.3.
CVE-2026-1277
Medium · 4.7
Public exploit CWE-601 Feb 18, 2026
URL Shortify <= 1.12.1 - Unauthenticated Open Redirect via 'redirect_to' Parameter
The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link.
CVE-2025-12581
Medium · 6.1
CWE-79 Dec 20, 2025
Attachments Handler <= 1.1.7 - Reflected Cross-Site Scripting
The Attachments Handler plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.