Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · simple-urls
simple-urls
7 known vulnerabilities on record. Add your version above to see which ones affect you.
Jul 2, 2026Author Cross Site Scripting (XSS) in Simple URLs <= 151 versions.CVE-2026-57762 · reported by PatchstackMedium 5.9
Author Cross Site Scripting (XSS) in Simple URLs <= 151 versions.
Dec 13, 2024Simple URLs: Missing AuthorizationCVE-2023-40678 · affects up to 117 · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Andrew Fiebert Simple URLs simple-urls allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple URLs: from n/a through <= 117.
Nov 30, 2023Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-40674 · affects up to 118 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lasso Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management allows Stored XSS.This issue affects Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management: from n/a through 118.
Oct 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in Lasso Simple URLs plugin <= 120 versions.CVE-2023-45606 · affects up to 120 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Lasso Simple URLs plugin <= 120 versions.
Sep 27, 2023Unauth.CVE-2023-40667 · affects up to 117 · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Lasso Simple URLs plugin <= 117 versions.
Feb 13, 2023Simple URLs: Does not sanitise and escape some parameters before outputting them back in some pagesCVE-2023-0099 · fixed in 115 · reported by WPScanMedium 6.1
The Simple URLs WordPress plugin before 115 does not sanitise and escape some parameters before outputting them back in some pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Feb 13, 2023Simple URLs: Does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated usersCVE-2023-0098 · fixed in 115 · reported by WPScanHigh 8.8
The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated users, leading to a SQL injection exploitable by low privilege users such as subscriber.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.