YOURLS version 1.5.1 through 1.10.4 stores the HTTP Referer header without proper escaping, allowing a crafted Referer to be embedded directly into an inline JavaScript chart on the statistics page. The resulting stored XSS enables any user who views that page—including administrators—to execute arbitrary scripts within the YOURLS origin. Attackers can read admin‑visible data, the API signature token, and perform privileged same‑origin actions, effectively compromising the entire site.

The vulnerability applies to all installations of YOURLS between release 1.5.1 and 1.10.4. Users of YOURLS older than 1.5.1 or newer than 1.10.4 are not affected, unless they manually re‑enable referrer logging with the same code path. No other vendors or products are listed as impacted.

The CVSS score of 8.2 indicates high severity. The EPSS score is not available, and the vulnerability is not present in the CISA KEV catalog, suggesting no publicly known exploits at the time of this analysis. The attack vector is likely a web request with a crafted Referer header, which can be sent from any device without authentication. An attacker only needs to trigger a redirect to a short URL to poison the statistics chart. Once the statistics page is rendered by an administrator or any authenticated user, the injected JavaScript runs with full site privileges. Because the flaw is stored, the impact spans all future views of the affected statistics page.