Shortcode Redirect
Shortcode Redirect has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2012 and 2025; all 2 are fixed as of September 2026. Their average CVSS score is 5.9, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
Every one of the 2 issues recorded for Shortcode Redirect has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Shortcode Redirect is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2025-54746Shortcode Redirect <= 1.0.02 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Shortcode Redirect
Author
cartpauj
Shortcode Redirect sends visitors from any post or page to another URL. No settings screens, no database tables — just drop it in where you need it. There are two ways to use it, and both produce the exact same front-end output. 1. The Redirect block (new in 1.1.0) In the block editor, add the Redirect block from the Widgets category. The block sidebar exposes three simple fields: Destination URL — where the visitor should end up Seconds to wait — how long to pause before redirecting (0 = immediate) Show “redirecting” message — toggle the visible “Please wait…” line on or off The editor shows a live summary of what the block will do, e.g. “Redirects to https://example.com — after 3 seconds · message shown”. No shortcode syntax to memorize. 2. The classic shortcode Paste into any post or page: [redirect url='https://example.com' sec='3'] Shortcode attributes: url — destination URL (required) sec — seconds to wait before redirecting (optional, default 0) show_message — set to false, 0, no, or off to hide the “redirecting” message (optional, default true, new in 1.1.0) Example with all three: [redirect url='https://example.com' sec='5' show_message='false'] Same output either way Block or shortcode, the front-end renders the same single <meta http-equiv="refresh"> tag (plus the optional one-line message). No JavaScript. No server-side redirect. No third-party tracking. Existing [redirect] shortcodes from earlier versions continue to work unchanged. Features Block editor support — native “Redirect” block (new in 1.1.0) Classic shortcode — [redirect] works exactly like it always has Optional delay — choose how many seconds to wait before redirecting Silent mode — hide the “redirecting…” message for a clean, blank-page redirect (new in 1.1.0) Lightweight — a single PHP file plus a small block; no settings, no tables, no dependencies Backwards compatible — upgrading from 1.0.x is drop-in
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C