CVE-2023-4294 URL Shortify < 1.7.6 - Unauthenticated Stored XSS via referer header

2023-09-1119:46:09

WPScan

www.cve.org

cve-2023-4294

url shortify

unauthenticated

stored xss

wordpress plugin

0.001 Low

EPSS

Percentile

30.2%

JSON

The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short link.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "URL Shortify",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.7.6"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/1fc71fc7-861a-46cc-a147-1c7ece9a7776

0.001 Low

EPSS

Percentile

30.2%

JSON

Related for CVELIST:CVE-2023-4294