WordPress Plugin Vulnerabilities

0mk Shortener <= 0.2 - Stored XSS via CSRF

Description

The plugin does not have CSRF check in its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

Affects Plugins

Plugin icon
0mk-shortener
No known fix

References

CVE
CVE-2022-2933

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Juampa Rodríguez
Verified
No
WPVDB ID
31da5005-fa1c-4a04-91c8-940a896656bc

Timeline

Publicly Published
2023-02-06 (about 3 years ago)
Added
2023-02-06 (about 3 years ago)
Last Updated
2023-02-06 (about 3 years ago)

Other

Published
Title
Published
2024-01-04
Title
Depicter Slider < 2.0.7 - Settings Update via CSRF
Published
2025-04-24
Title
Twitter Card Generator <= 1.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-03-24
Title
WordPress Admin Bar Improved <= 3.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2022-09-01
Title
CallRail Phone Call Tracking < 0.4.10 - Stored XSS via CSRF
Published
2024-03-27
Title
Events Manager < 6.4.7.2 - Cross-Site Request Forgery