What’s Vulnerable › Vulnerabilities

CVE-2023-2921: Short URL <= 1.6.8 - Subscriber+ SQLi

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-06-06 · updated 2026-06-17
• Weakness: CWE-89

Description

The Short URL WordPress plugin through 1.6.8 does not properly sanitise and escape a parameter before using it in SQL statement, leading to a SQL injection exploitable by users with relatively low privilege on the site, like subscribers.

Affected products

• KaizenCoders Short URL: before 1.6.8 — fixed in 1.6.8

How to fix

Upgrade to a fixed version: KaizenCoders Short URL 1.6.8. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/0f85db4f-8493-4941-8f3c-e5258c581bdc/
• https://wpscan.com/vulnerability/0f85db4f-8493-4941-8f3c-e5258c581bdc/

Get alerted when CVE-2023-2921 or the next vulnerability affects your stack