PT-2023-15932 · WordPress · Frontend Post Wordpress Plugin

Published 2023-06-05 · Updated 2025-01-08 · CVE-2022-4946

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frontend Post WordPress Plugin versions through 2.8.4

Description The issue concerns a lack of validation for an attribute in one of the plugin's shortcodes. This could allow users with a role as low as contributor to add a malicious shortcode to a page or post, resulting in redirects to an arbitrary domain.

Recommendations For versions through 2.8.4, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-4946

Affected Products

Frontend Post Wordpress Plugin

References · 4

• 🔥 https://wpscan.com/vulnerability/6e222018-a3e0-4af0-846c-6f00b67dfbc0 · Exploit
• https://osv.dev/vulnerability/CVE-2022-4946 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4946 · Security Note
• https://t.me/cvenotify/51752 · Telegram Post