CVE-2026-73362: WordPress URL Shortify plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

Q: Which deployments are exposed, and does exploitation require authentication?

Sites running URL Shortify version 2.5.0 or earlier are affected. The issue is classified as unauthenticated, so an attacker does not need a WordPress account or plugin-specific privileges.

Q: What does an attacker need to exploit this issue, and what can be done if patching is delayed?

The vector is network-accessible and has low attack complexity, but user interaction is required. The provided data does not specify the exact interaction needed or identify a mitigation other than moving off affected versions.

Published Aug 18, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.

Affected Software

1 affected component

WordPress URL Shortify Plugin<=2.5.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress URL Shortify plugin to a version that resolves this vulnerability.
Fixed in 2.5.1

Event History

Aug 18, 2026

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed, and does exploitation require authentication?

Sites running URL Shortify version 2.5.0 or earlier are affected. The issue is classified as unauthenticated, so an attacker does not need a WordPress account or plugin-specific privileges.

What does an attacker need to exploit this issue, and what can be done if patching is delayed?