{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0813", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-09T15:31:18.848Z", "datePublished": "2026-01-14T06:40:05.955Z", "dateUpdated": "2026-04-08T17:04:43.677Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:04:43.677Z"}, "affected": [{"vendor": "prasannasp", "product": "Short Link", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Short Link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'short_link_post_title' and 'short_link_page_title' parameters in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page."}], "title": "Short Link <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Administration Settings Page", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8623d2cc-dcdd-4453-9a86-669bdd44eae1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/short-link/tags/1.0/short-link.php#L118"}, {"url": "https://plugins.trac.wordpress.org/browser/short-link/trunk/short-link.php#L118"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Bhumividh Treloges"}], "timeline": [{"time": "2026-01-13T17:30:17.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-14T20:58:56.439770Z", "id": "CVE-2026-0813", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T20:59:03.055Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0813", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-14T20:58:56.439770Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T20:58:59.990Z"}}], "cna": {"title": "Short Link <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Administration Settings Page", "credits": [{"lang": "en", "type": "finder", "value": "Bhumividh Treloges"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "prasannasp", "product": "Short Link", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-13T17:30:17.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8623d2cc-dcdd-4453-9a86-669bdd44eae1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/short-link/tags/1.0/short-link.php#L118"}, {"url": "https://plugins.trac.wordpress.org/browser/short-link/trunk/short-link.php#L118"}], "descriptions": [{"lang": "en", "value": "The Short Link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'short_link_post_title' and 'short_link_page_title' parameters in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:04:43.677Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0813", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:04:43.677Z", "dateReserved": "2026-01-09T15:31:18.848Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-14T06:40:05.955Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Short Link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'short_link_post_title' and 'short_link_page_title' parameters in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page."}, {"lang": "es", "value": "El plugin Short Link para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de los par\u00e1metros 'short_link_post_title' y 'short_link_page_title' en todas las versiones hasta la 1.0, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de nivel de administrador y superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a la p\u00e1gina inyectada."}], "id": "CVE-2026-0813", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-01-14T07:16:16.027", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/short-link/tags/1.0/short-link.php#L118"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/short-link/trunk/short-link.php#L118"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8623d2cc-dcdd-4453-9a86-669bdd44eae1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-16T18:07:33.423439+00:00", "value": {"mitigation_remediation": ["Upgrade the Short Link plugin to a version that removes the unsanitized input handling, or uninstall the plugin if it is no longer required.", "If a patch is not yet available, restrict administrative access to the plugin\u2019s settings page and disable the plugin on publicly accessible installations.", "Apply a strict Content\u2011Security\u2011Policy header to the WordPress site to reduce the impact of any remaining XSS payloads."], "summary": {"action": "Update Plugin", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Short Link plugin developed by prasannasp. All releases up to and including version 1.0 are impacted, as indicated by source code references in those releases.", "description_and_impact": "The WordPress Short Link plugin contains a stored cross\u2011site scripting flaw involving the short_link_post_title and short_link_page_title parameters. Input supplied through the administration settings page is not properly sanitized or escaped, allowing an attacker who holds administrator or higher privileges to insert arbitrary JavaScript. When a site visitor loads the affected page, the injected script executes in the visitor\u2019s browser, potentially altering page content or performing other client\u2011side actions.", "risk_and_exploitability": "The severity score assigned to this flaw is 4.4, indicating moderate potential impact. Exploitation requires legitimate administrative access and the ability to modify the plugin\u2019s settings. Current analysis suggests a low probability of exploitation, and the issue is not listed as a known exploited vulnerability. Because the attack vector is local to privileged users, the overall risk remains moderate, but the consequence of an attacker\u2019s payload could be significant for all visitors to the affected page."}}}}, "created": "2026-01-15T08:03:59.167038+00:00", "updated": "2026-04-16T18:15:43.294279+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}