Software intelligence

Pretty Link vulnerabilities

9 tracked advisories · slug pretty-link

Important: Pretty Link appearing in this catalog does not mean your website is affected. Exposure depends on your installed version. How SiteRespond intelligence works

Tracked advisories

Latest advisory

4 August 2026

CISA KEV matches

In this WordPress feed

WordPress slug

pretty-link

Plugin

What this means for Pretty Link

This catalog lists 9 known advisories affecting Pretty Link. The most recent was published on 4 August 2026. If you use this software, compare your installed version against the affected ranges on each advisory and update to a fixed release outside those ranges. SiteRespond Defence checks your actual installed version when the plugin is connected — listing here does not by itself mean your site is vulnerable.

Latest issues

PrettyLinks <= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' Parameter
May allow attackers to read or modify database contents beyond intended access.
Published 4 August 2026
Shortlinks by Pretty Links <= 3.6.15 - Missing Authorization
This advisory describes a other issue in the affected software. Review the source advisory and your installed version to assess exposure.
Published 19 May 2025
Shortlinks by Pretty Links <= 3.6.2 - Reflected Cross-Site Scripting via post_status
May allow attackers to run scripts in visitors' browsers or hijack admin sessions.
Published 25 March 2024

Vulnerability types

Cross-site scripting4
SQL injection2
CSRF2

Authentication (inferred from titles)

Unauthenticated1
Authenticated1
Unspecified7

Advisory history

Known Pretty Link advisories published by month.

Oct 25

Nov 25

Dec 25

Jan 26

Feb 26

Mar 26

Apr 26

May 26

Jun 26

Jul 26

Aug 26

Sept 26

All advisories

PrettyLinks <= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' Parameter
CVE-2026-5062 · Published 4 August 2026
Affected versions: ≤ 3.6.20
Shortlinks by Pretty Links <= 3.6.15 - Missing Authorization
CVE-2025-48247 · Published 19 May 2025
Affected versions: ≤ 3.6.15
Shortlinks by Pretty Links <= 3.6.2 - Reflected Cross-Site Scripting via post_status
CVE-2024-29770 · Published 25 March 2024
Affected versions: ≤ 3.6.2
Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin <= 3.6.3 - Cross-Site Request Forgery to Plugin Settings Update
CVE-2024-2326 · Published 22 March 2024
Affected versions: ≤ 3.6.3
Shortlinks by Pretty Links <= 3.4.0 - Cross-Site Request Forgery via route
CVE-2022-47149 · Published 13 April 2023
Affected versions: ≤ 3.4.0
Pretty Links <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via track_link
CVE-2019-25147 · Published 19 June 2019
Affected versions: < 2.1.10
Pretty Links – Link Management, Branding, Tracking & Sharing Plugin <= 1.6.7 - SQL Injection
CVE-2015-9457 · Published 8 July 2015
Affected versions: < 1.6.8
Pretty Links Lite < 1.6.3 - Stored Cross-Site Scripting
CVE-2013-1636 · Published 1 August 2014
Affected versions: < 1.6.3
Pretty Links – Link Management, Branding, Tracking & Sharing Plugin < 1.5.6 - Reflected Cross-Site Scripting
CVE-2011-4595 · Published 4 December 2011
Affected versions: < 1.5.6

Check whether your installed version is affected

SiteRespond Defence matches your installed Pretty Link version against this catalog when the Defence plugin is connected to your WordPress site.

Start SiteRespond Defence for WordPress — £29.99/monthScan your website