CVE-2023-2921 in Short URL Plugin

Résumé

par MITRE • 06/06/2025

The Short URL WordPress plugin through 1.6.8 does not properly sanitise and escape a parameter before using it in SQL statement, leading to a SQL injection exploitable by users with relatively low privilege on the site, like subscribers.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Responsable: WPScan
• Réserver: 26/05/2023
• Divulgation: 06/06/2025
• Modérer: accepté
• Entrée: VDB-311321
• CPE: prêt
• CWE: CWE-89 (confirmé)
• CVSS: 6.3 (VulDB)
• EPSS: 0.00366
• KEV: non
• Activités: très faible
• Secteur: Hostingprovider

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2023-2921
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-2921
• CVE Details: https://www.cvedetails.com/cve/CVE-2023-2921/