5.4
Medium
CVE-2022-4946 The Frontend Post WordPress Plugin WordPress plugin through 2.8.4 does not validate an attribute of one of its…
Description
The Frontend Post WordPress Plugin WordPress plugin through 2.8.4 does not validate an attribute of one of its shortcode, which could allow users with a role as low as contributor to add a malicious shortcode to a page/post, which will redirect users to an arbitrary domain.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Frontend Post WordPress Plugin 2.8 | earliest → 2.8.4 | No fix stated |