PT-2025-51090 · WordPress · Url Shortener Plugin For Wordpress

Ifoundbug · CVE-2025-10738 · Published 2025-12-13 · Updated 2025-12-18

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions URL Shortener Plugin For WordPress versions through 3.0.7

Description The URL Shortener Plugin For WordPress is susceptible to SQL Injection due to inadequate input validation and query preparation. Specifically, the analytic id parameter is not properly sanitized, allowing attackers to inject malicious SQL code. This enables unauthenticated attackers to extract sensitive information from the database by appending additional SQL queries to existing ones.

Recommendations Update URL Shortener Plugin For WordPress to a version newer than 3.0.7.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-10738

Affected Products

Url Shortener Plugin For Wordpress

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-10738 · Security Note
• https://twitter.com/cracbot/status/2001608421280559506 · Twitter Post
• https://wordpress.org/plugins/exact-links · Note
• https://twitter.com/CveFindCom/status/1999882203342274844 · Twitter Post
• https://twitter.com/offseq/status/1999736690492252237 · Twitter Post
• https://twitter.com/MNovofastovsky/status/2001683876469424183 · Twitter Post
• https://plugins.trac.wordpress.org/browser/exact-links/trunk/app/Models/LinkAnalytics.php?rev=3210852 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/1b4acf11-114a-4e97-89cd-1d387f14a730?source=cve · Note
• https://twitter.com/CVEnew/status/1999865335051395559 · Twitter Post
• https://t.me/CVEtracker/39706 · Telegram Post
• https://twitter.com/0dayPublishing/status/1999731105939767562 · Twitter Post