utm.codes
utm.codes has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Server-Side Request Forgery (SSRF), behind 1 of the records (100%).
The one issue recorded for utm.codes has a vendor fix available, so running the current release closes it.
All of these findings were reported by theviper17. utm.codes is installed on roughly 400 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2026-56026utm.codes <= 1.9.0 - Authenticated (Subscriber+) Server-Side Request Forgery
Read the full analysisVulnerability Records

utm.codes
Author
Chris Carlevato
It’s time to ditch the spreadsheets for a better way to create and manage your campaign marketing links. utm.codes turns your WordPress admin into a link building powerhouse by making it easier to create, organize, and use your links. For more information, videos, and helpful tips visit the utm.codes website. Features Easily create campaign marketing links with UTM codes for better campaign analytics Automatically format links in lowercase, remove spaces, and remove non alphanumeric characters for more consistent reporting Batch create links for all your social networks with just a click Search, filter, and easily find existing links using familiar WordPress admin controls Automatically detect url error responses to prevent creating bad links One click link shortening with Bitly or Rebrandly for easier link sharing Save notes with link for team communication, usage context, future reference, and more Link element API filter for custom utm code formatting Social network options API filter for custom batch link options Shortener API filter for custom link shortening Supports adding additional custom parameters to links for improved versatility Multi-user access within WordPress to share creation and management responsibilities See your current link count in the admin dashboard “At a Glance” Actively tested with WordPress 6.4, 6.5, 6.6, 6.7, 6.8, 6.9, 7.0, and 7.1 Actively tested with PHP 7.4, 8.0, 8.1, 8.2, 8.3, and 8.4 Actively tested with MySQL 8.0, 8.4 100% Free and Open Source Installation Upload the utm.codes plugin to your WordPress site, activate it, and start creating your links. Settings Configure your formatting preferences, targeted social networks, link notes, and shortening preferences, under Settings / utm.codes to enable batch creation and shorten when saving links. Documentation For additional details about installing, configuring, customizing, and using utm.codes visit our GitHub wiki Development Resources utm.codes is built using development code not included in the WordPress.org download because it isn’t required for use. This code includes the webpack build used to create our minified CSS and JavaScript as well as PHPUnit tests to ensure support of new WordPress releases. All source code associated with utm.codes is open source, free to use for any purpose, and released under the GPL v2.0 license. Development code, including instructions for running both the build and tests, is available at the utm.codes GitHub repository. You can also browse our build history at GitHub.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C