Frontend Post WordPress Plugin <= 2.8.4 - Contributor+ Arbitrary Redirect
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.4epss 0.4%
exploitation probability
0.4%top 63% of all CVEs
observed exploitation
nono source reports it
The Frontend Post WordPress Plugin WordPress plugin through 2.8.4 does not validate an attribute of one of its shortcode, which could allow users with a role as low as contributor to add a malicious shortcode to a page/post, which will redirect users to an arbitrary domain.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
Unknown · Frontend Post WordPress Plugin