CoreCVE
Back

MEDIUM

The Short URL plugin for WordPress is vulnerable to stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping in versions up to, and including, 1.6.4

Published Jun 29, 2023

Description

The Short URL plugin for WordPress is vulnerable to stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping in versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (3)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Wordfence
Published Jun 29, 2023
Updated Oct 28, 2024
Reserved Mar 23, 2023
Link CVE-2023-1602
CISA Vulnrichment
Updated Oct 28, 2024
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2023-1602
Red Hat
Severity n/a
Public date n/a
Links CVE-2023-1602