Vulnerability · Published Jun 6, 2025 · Assigned by WPScan
CVE-2023-2921Short URL <= 1.6.8 - Subscriber+ SQLi
High 8.8
In plain English
A high-severity security flaw in Short URL from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 60.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Short URL WordPress plugin through 1.6.8 does not properly sanitise and escape a parameter before using it in SQL statement, leading to a SQL injection exploitable by users with relatively low privilege on the site, like subscribers.
Affected products (as reported)
References
- https://wpscan.com/vulnerability/0f85db4f-8493-4941-8f3c-e5258c581bdc/ exploit, vdb-entry, technical-description