CVE-2023-4294

URL Shortify < 1.7.6 - Unauthenticated Stored XSS via referer header

Medium · published September 11, 2023

CVSS v3.1
6.1
EPSS
1%
Percentile
56.8
In the wild
Unconfirmed
What it is

The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short link.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00820 · 56.8th percentile
Published
2023-09-11T19:46Z
EPSS history
Timeline
  • 11 SEP 19:46Z
    URL Shortify < 1.7.6 - Unauthenticated Stored XSS via referer header
    cvelistv5