CVE-2023-2921 in Short URL Plugin

Riassunto

di MITRE • 06/06/2025

The Short URL WordPress plugin through 1.6.8 does not properly sanitise and escape a parameter before using it in SQL statement, leading to a SQL injection exploitable by users with relatively low privilege on the site, like subscribers.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Responsabile: WPScan
• Prenotare: 26/05/2023
• Divulgazione: 06/06/2025
• Moderazione: accettato
• Voce: VDB-311321
• CPE: pronto
• CWE: CWE-89 (confermato)
• CVSS: 6.3 (VulDB)
• EPSS: 0.00366
• KEV: no
• Attività: molto basso
• Settore: Hostingprovider

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2023-2921
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-2921
• CVE Details: https://www.cvedetails.com/cve/CVE-2023-2921/