CVE-2023-2921

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Short URL WordPress plugin through 1.6.8 does not properly sanitise and escape a parameter before using it in SQL statement, leading to a SQL injection exploitable by users with relatively low privilege on the site, like subscribers.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jun 6, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-292108.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible doc CVE-2023-292118.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` c CVE-2023-292128.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groo CVE-2023-292138.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of `org.xwiki.CVE-2023-292148.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groo CVE-2023-292159.8In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in J CVE-2023-292169.8In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker uses the MySQL data source and malicious paramet CVE-2023-292187.5The Twitter Recommendation Algorithm through ec83d01 allows attackers to cause a denial of service (reduction of reputation score) by arrang CVE-2023-29226.1A vulnerability classified as problematic has been found in SourceCodester Comment System 1.0. Affected is an unknown function of the file i CVE-2023-29239.8A vulnerability classified as critical was found in Tenda AC6 US_AC6V1.0BR_V15.03.05.19. Affected by this vulnerability is the function from CVE-2023-292349.8A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2 CVE-2023-292358.8Cross-Site Request Forgery (CSRF) vulnerability in Fugu Maintenance Switch plugin <= 1.5.2 versions.