CVE-2022-45361

CVE-2022-45361 affects the WordPress plugin 0mk Shortener up to version 0.2. The root cause is inadequate sanitisation/escaping of settings, enabling an authenticated admin+ to perform a Stored XSS, even when unfiltered_html is disallowed. Impact is described as admin-level XSS with low confident...

CVE-2022-2933

CVE-2022-2933 (0mk Shortener WordPress plugin) is a Cross-Site Request Forgery vulnerability in versions up to 0.2 caused by missing or incorrect nonce validation in the zeromk_options_page function. This allows unauthenticated attackers to inject malicious scripts via the zeromk_user and zeromk_...