The WP URL Shortener plugin allows attackers to perform cross‑site request forgery on the settings page because a nonce check is missing or implemented incorrectly. By sending a forged request to this page, an unauthenticated attacker can modify plugin settings and inject arbitrary web scripts that are then stored in the database. The injected scripts execute in the context of the site, giving an attacker the ability to hijack administrator sessions, steal credentials, or distribute malware to visitors. This vulnerability directly results in a stored cross‑site scripting flaw governed by CWE‑352.

This flaw affects the djerba: WP URL Shortener plugin for WordPress in all releases up to and including version 1.2. No other versions are listed as affected by the CNA.

The CVSS score of 6.1 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, so no known widespread exploitation has been reported. The attack requires an attacker to trick a site administrator into clicking a crafted link or submitting a form, creating a CSRF exploit path that is easy to engineer but requires human interaction. Attackers can therefore gain escalated privileges on the affected WordPress instance, though they must rely on social engineering to complete the attack.