WP Dynamic Links
WP Dynamic Links has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for WP Dynamic Links has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Nguyen Xuan Chien. WP Dynamic Links is installed on roughly 50 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.1.42.
CVE-2025-49038WP Dynamic Links <= 1.0.1 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records

WP Dynamic Links
Author
Soflyy
Shorten your links. Turn long URLs into your-domain.com/short-url. Great for affiliate marketers who want to cloak their links, or anyone else who wants to have pretty URLs and track their outbound traffic. Here’s how it works: 1) Click on ‘Create Link’ in the WP Dynamic Links section of WordPress admin panel. 2) Enter a name for the link (for management purposes) and a ‘slug’ name for the URL (for example, www.your-domain.com/slug-name). 3) Enter the destination URL for the cloaked link, i.e. www.some-external-url.com/some-page 4) Click ‘Save Link.’ After that, you can use the WP Dynamic Links-powered link everywhere you would have used the original URL. WP Dynamic Links will track clicks on your links, providing a detailed summary and information on individual clicks like browser type, IP address, country code, and referring URL. Features Generate click reports for any time period, and export all click data to CSV for further analysis. Automatically turn keywords on your site into links. Specify the keyword and it will be replaced in your Pages/Posts with a link. Send visitors in different countries to different destinations. Useful for affiliate marketers who want to promote country-specific offers. your-domain.com/4-hour-work-week can send German visitors to Amazon.de and US visitors to Amazon.com. Automatically match existing URLs on your site in your existing Pages/Posts. If you have links to whatever.com you can turn them all into links to your-domain.com/whatever. Support for sub IDs. Support for a prefix so you can have your-domain.com/prefix/your-link instead of your-domain.com/your-link
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C