CVE-2025-10133: URLYar URL Shortner XSS Vulnerability

CVE-2025-10133 Overview

The URLYar URL Shortner plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the urlyar_shortlink shortcode. The flaw affects all plugin versions up to and including 1.1.0. Authenticated users with contributor-level access or above can inject arbitrary JavaScript into pages that use the shortcode. The injected scripts execute in the browser of any visitor who loads the affected page. The vulnerability is classified under CWE-79 for improper neutralization of input during web page generation.

Critical Impact
Contributor-level WordPress accounts can plant persistent JavaScript payloads that execute against site visitors and administrators, enabling session theft, forced redirects, and administrative account takeover.

Affected Products

URLYar URL Shortner plugin for WordPress, all versions through 1.1.0
WordPress sites that allow contributor-level (or higher) user registration
Pages and posts that render the urlyar_shortlink shortcode

Discovery Timeline

2025-10-15 - CVE-2025-10133 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10133

Vulnerability Analysis

The vulnerability resides in the plugin's urlyar_shortlink shortcode handler, which accepts user-supplied attributes and renders them into page output. The handler does not sufficiently sanitize input or escape output before writing attribute values into the HTML response. An authenticated attacker with contributor privileges can embed the shortcode in a post and pass attribute values containing HTML or JavaScript. When any user renders the page, the browser interprets the injected markup as active script content.

Because the payload is stored in the WordPress database and served on every page view, this is a persistent (stored) XSS rather than a reflected variant. The scope change reflected in the CVSS vector indicates that script execution crosses a trust boundary, since injected code runs against site visitors and site administrators who preview or manage the content. Successful exploitation can result in session cookie theft, forced browser actions on behalf of a logged-in administrator, defacement, or delivery of secondary payloads.

Root Cause

The root cause is missing input sanitization and missing output escaping in the shortcode callback. WordPress provides helpers such as sanitize_text_field() for input and esc_attr() or esc_html() for output, but the affected code path passes attribute values into the rendered HTML without applying them. The shortcode source is available in the WordPress Plugin Source Code.

Attack Vector

Exploitation requires an authenticated account with contributor-level access or higher on the target WordPress site. The attacker creates or edits a post containing the urlyar_shortlink shortcode with a malicious attribute value. Once the post is rendered, whether via preview, publication after review, or direct access, the injected JavaScript executes in the visitor's browser under the site's origin. No user interaction beyond loading the page is required.

Refer to the Wordfence Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-10133

Indicators of Compromise

Posts or pages containing urlyar_shortlink shortcode attributes with HTML tags, javascript: URIs, or event handlers such as onerror and onmouseover
Unexpected <script> tags, iframes, or inline event handlers in rendered post content produced by the plugin
Outbound requests from visitor browsers to attacker-controlled domains originating from pages that use the shortcode
New administrator accounts or unexpected role escalations following contributor activity

Detection Strategies

Query the wp_posts table for post content matching [urlyar_shortlink combined with suspicious characters such as <, >, onerror=, or javascript:
Enable Content Security Policy (CSP) reporting to surface inline script execution on pages that should not contain scripts
Review contributor and author activity logs for shortcode usage patterns that deviate from normal editorial workflows

Monitoring Recommendations

Alert on creation or modification of posts by contributor-level accounts, especially when the content includes shortcode attributes with special characters
Monitor web server access logs for unusual referrers or query strings tied to pages rendering the shortcode
Track administrator session anomalies such as unexpected geolocation, new devices, or privileged actions immediately after viewing contributor-submitted content

How to Mitigate CVE-2025-10133

Immediate Actions Required

Update the URLYar URL Shortner plugin to a version above 1.1.0 once the vendor publishes a fix, or deactivate and remove the plugin if no patched release is available
Audit all posts and pages that use the urlyar_shortlink shortcode and remove suspicious attribute values
Restrict contributor-level account creation and review existing low-privilege accounts for unexpected activity
Rotate administrator session cookies and credentials if injected scripts may have executed against privileged users

Patch Information

At the time of the last NVD update, no fixed version has been referenced in the advisory. Monitor the WordPress Plugin Source Code repository and the Wordfence Vulnerability Report for updates on a patched release.

Workarounds

Deactivate the URLYar URL Shortner plugin until a patched version is available
Deploy a web application firewall rule that blocks requests containing shortcode attributes with HTML tags or script-related keywords
Enforce a strict Content Security Policy that disallows inline scripts on pages rendered by WordPress
Limit publishing workflows so that contributor submissions require editor review before content is rendered publicly

bash

# Configuration example: disable the plugin via WP-CLI until a patch is available
wp plugin deactivate urlyar
wp plugin delete urlyar