SEGURIDAD DE PLUGINS
Vulnerabilidades conocidas, compatibilidad con PHP y alternativas más seguras para el plugin de WordPress Pretty Link — verificado contra la base de datos de seguridad local de WP Clinic.
pretty-linkaffiliate linkslink cloakinglink managementlink trackingurl shortener
9 CVEs conocidos registrados para Pretty Link. Reportadas entre 2011 y 2025.
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| CVE-2025-48247 | PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links [pretty-link] < 3.6.16 | Falta de control de autorización | Media 4,3 | < 3.6.16 | 3.6.16 | 2025-05-19 | ✓ corregido en la última versión |
| CVE-2024-29770 | PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links [pretty-link] < 3.6.3 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Alta 7,1 | < 3.6.3 | 3.6.3 | 2024-03-25 | ✓ corregido en la última versión |
| CVE-2024-2326 | PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links [pretty-link] < 3.6.4 | Falsificación de petición en sitios cruzados (CSRF) | Media 4,3 | < 3.6.4 | 3.6.4 | 2024-03-22 | ✓ corregido en la última versión |
| CVE-2022-47149 | PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links [pretty-link] < 3.4.1 | Falsificación de petición en sitios cruzados (CSRF) | Media 4,3 | < 3.4.1 | 3.4.1 | 2023-04-13 | ✓ corregido en la última versión |
| — | PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links [pretty-link] < 2.1.10 | — | Desconocido | < 2.1.10 | 2.1.10 | 2019-06-25 | ✓ corregido en la última versión |
| — | PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links [pretty-link] < 2.1.10 | — | Desconocido | < 2.1.10 | 2.1.10 | 2019-06-25 | ✓ corregido en la última versión |
| CVE-2019-25147 | PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links [pretty-link] < 2.1.10 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Alta 7,2 | < 2.1.10 | 2.1.10 | 2019-06-19 | ✓ corregido en la última versión |
| — | PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links [pretty-link] < 1.6.1 | — | Desconocido | < 1.6.1 | 1.6.1 | 2016-07-07 | ✓ corregido en la última versión |
The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the search_results() function in all versions up to, and including, 3.6.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to search link statuses.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
Update the WordPress Shortlinks by Pretty Links plugin to the latest available version (at least 3.6.3). Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Shortlinks by Pretty Links Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.6.3. This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance. Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.3. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possible for unauthenticated attackers to change the plugin's configuration including stripe integration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
Update the WordPress Shortlinks by Pretty Links plugin to the latest available version (at least 3.4.1). Muhammad Daffa discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Shortlinks by Pretty Links Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 3.4.1.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
Stored Cross-Site Scripting (XSS) vulnerability found by Jerome Bruandet in WordPress Shortlinks by Pretty Links plugin (versions <= 2.1.9).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
CSV injection vulnerability found by Jerome Bruandet in WordPress Shortlinks by Pretty Links plugin (versions <= 2.1.9).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The Pretty Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various IP headers as well as the referer header in versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping in the track_link function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Upgrade plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| — | PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links [pretty-link] < 1.6.8 | — | Desconocido | < 1.6.8 | 1.6.8 | 2015-11-22 | ✓ corregido en la última versión |
| CVE-2015-9457 | PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links [pretty-link] < 1.6.8 | Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) | Alta 7,2 | < 1.6.8 | 1.6.8 | 2015-07-08 | ✓ corregido en la última versión |
| CVE-2013-1636 | PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links [pretty-link] < 1.6.3 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Desconocido | < 1.6.3 | 1.6.3 | 2014-03-12 | ✓ corregido en la última versión |
| — | PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links [pretty-link] < 1.6.4 | — | Desconocido | < 1.6.4 | 1.6.4 | 2013-02-20 | ✓ corregido en la última versión |
| — | PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links [pretty-link] < 1.5.3 | — | Desconocido | < 1.5.3 | 1.5.3 | 2012-05-15 | ✓ corregido en la última versión |
| CVE-2011-5192 | PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links [pretty-link] < 1.5.6 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Desconocido | < 1.5.6 | 1.5.6 | 2012-01-06 | ✓ corregido en la última versión |
| CVE-2011-5191 | PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links [pretty-link] < 1.5.4 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Desconocido | < 1.5.4 | 1.5.4 | 2011-12-12 | ✓ corregido en la última versión |
| — | PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links [pretty-link] < 1.4.6 | — | Desconocido | < 1.4.6 | 1.4.6 | 2011-10-13 | ✓ corregido en la última versión |
| — | PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links [pretty-link] <= 1.4.56 | — | Desconocido | < 1.4.56 | 1.4.56 | 2011-06-27 | ✓ corregido en la última versión |
| — | PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links [pretty-link] < 1.6.1 | — | Desconocido | < 1.6.1 | 1.6.1 | — | ✓ corregido en la última versión |
Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands. Upgrade the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The Pretty Links – Link Management, Branding, Tracking & Sharing Plugin WordPress plugin was affected by an Authenticated SQL Injection security vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: WPScan
Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in the Pretty Link Lite plugin before 1.6.3 for WordPress, JNews (com_jnews) component 8.0.1 for Joomla!, and CiviCRM 3.1.0 through 4.2.9 and 4.3.0 through 4.3.3, allows remote attackers to inject arbitrary web script or HTML via the get-data parameter.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
WordPress Pretty Link is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based authentication credentials. Other attacks are also possible. Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
Pretty Link Lite plugin is prone to multiple cross-site scripting and SQL-injection vulnerabilities because of failure to properly clean up user-supplied input. It allows an attacker to steal cookie-based authentication credentials, access or modify data, compromise the application or exploit latent vulnerabilities in the underlying database. Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite plugin before 1.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the slug parameter, a different vulnerability than CVE-2011-5191.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite plugin before 1.5.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the slug parameter, a different vulnerability than CVE-2011-5192.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
WordPress Pretty Link plugin is prone to multiple cross-site scripting vulnerabilities that fail to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based authentication credentials. Other attacks are also possible. Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
This WordPress Pretty Link Lite plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The Pretty Links – Link Management, Branding, Tracking & Sharing Plugin WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: WPScan
Mantén Pretty Link actualizado — 4.0.9 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.
Ejecuta un escaneo pasivo gratis ahora, o crea una cuenta gratuita e instala el plugin de WP Clinic para un escaneo profundo de toda tu cuenta de hosting y reparación asistida por IA.