The WordPress Short Link plugin contains a stored cross‑site scripting flaw involving the short_link_post_title and short_link_page_title parameters. Input supplied through the administration settings page is not properly sanitized or escaped, allowing an attacker who holds administrator or higher privileges to insert arbitrary JavaScript. When a site visitor loads the affected page, the injected script executes in the visitor’s browser, potentially altering page content or performing other client‑side actions.

The vulnerability affects the Short Link plugin developed by prasannasp. All releases up to and including version 1.0 are impacted, as indicated by source code references in those releases.

The severity score assigned to this flaw is 4.4, indicating moderate potential impact. Exploitation requires legitimate administrative access and the ability to modify the plugin’s settings. Current analysis suggests a low probability of exploitation, and the issue is not listed as a known exploited vulnerability. Because the attack vector is local to privileged users, the overall risk remains moderate, but the consequence of an attacker’s payload could be significant for all visitors to the affected page.