URL Shortify WordPress Plugin Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the URL Shortify WordPress plugin, affecting versions prior to 1.11.4. The issue arises because the plugin fails to properly sanitize and escape a parameter before displaying it on the page. This vulnerability could be exploited against users with high privileges, such as administrators.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, a logged-in administrator must be made to open a specially crafted URL that includes an unsanitized parameter. This URL should be structured to include a script payload, such as an alert script, which will be executed when the link is clicked.

Remediation

Users are advised to update the URL Shortify WordPress plugin to version 1.11.4 or later.