WordPress security by component
Pretty Link
Pretty Link (pretty-link) is a WordPress plugin with 6 published CVE records in this archive. The latest tracked vulnerability was published Aug 05, 2026; the highest published CVSS base score is 7.2.
Plugin slug:
pretty-linkLatest vulnerability
CVE-2026-5062: PrettyLinks administrative search parameter permits SQL injection
PrettyLinks through 3.6.20 passes the attacker-controlled s parameter from the Pretty Links administrative listing page into search_links_table() without sufficient escaping or query preparation. An Administrator can append SQL to the existing query and extract sensitive database contents. This 4.9-scored record received deeper review because the underlying primitive is SQL injection, although the disclosed path already requires Administrator access; the CNA does not identify a lower-privilege or unauthenticated route.
| Safe version |
|
||
|---|---|---|---|
| Aug 05, 2026 |
CVE-2026-5062
PrettyLinks administrative search parameter permits SQL injection
PrettyLinks through 3.6.20 passes the attacker-controlled s parameter from the Pretty Links administrative listing page into search_links_table() without sufficient escaping or query preparation. An Administrator can append SQL to the existing query and extract sensitive database contents. This 4.9-scored record received deeper review because the underlying primitive is SQL injection, although the disclosed path already requires Administrator access; the CNA does not identify a lower-privilege or unauthenticated route.
|
> 3.6.20 |
CVE4.9
NVDPending
|
| May 19, 2025 |
CVE-2025-48247
Shortlinks by Pretty Links: A security weakness
Shortlinks by Pretty Links is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Mar 27, 2024 |
CVE-2024-29770
Shortlinks by Pretty Links: Cross-site scripting
Shortlinks by Pretty Links is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE7.1
NVDPending
|
| May 25, 2023 |
CVE-2022-47149
Pretty Link: Cross-site request forgery
Pretty Link is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE4.3
NVD8.8
|
| Oct 10, 2019 |
CVE-2015-9457
Pretty Link: SQL injection
Pretty Link is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVEPending
NVD7.2
|
| Mar 12, 2014 |
CVE-2013-1636
Pretty Link: Cross-site scripting
Pretty Link is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVEPending
NVD4.3
|