SQL Injection Vulnerability in URL Shortener Plugin for WordPress
CVE-2025-10738
9.8CRITICAL
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 13 December 2025
What is CVE-2025-10738?
The URL Shortener Plugin for WordPress is vulnerable to SQL Injection through the 'analytic_id' parameter, allowing unauthorized users to manipulate SQL queries. This flaw arises from inadequate input sanitation and improper query preparation, opening the door for attackers to inject malicious SQL code. By exploiting this vulnerability, attackers can gain access to sensitive database information, potentially compromising the security of the WordPress site.
Affected Version(s)
URL Shortener Plugin For WordPress * <= 3.0.7