The 0mk Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the zeromk_options_page function. This makes it possible for unauthenticated attackers to inject malicious web scripts via the 'zeromk_user' and 'zeromk_apikluc' parameters through a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Metrics
Affected Vendors & Products
References
History
Mon, 13 Jan 2025 17:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|

Status: PUBLISHED
Assigner: Wordfence
Published: 2023-02-06T18:09:15.051Z
Updated: 2025-01-13T17:09:15.161Z
Reserved: 2022-08-22T13:52:25.641Z
Link: CVE-2022-2933

Updated: 2024-08-03T00:53:00.461Z

Status : Modified
Published: 2023-02-06T19:15:09.687
Modified: 2024-11-21T07:01:56.867
Link: CVE-2022-2933

No data.