PT-2023-17407 · WordPress · Pretty Url

Shezad Master · Published 2023-05-15 · Updated 2025-01-14 · CVE-2023-2009

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pretty Url WordPress plugin versions 1.5.4 and earlier

Description The issue arises from the plugin's failure to sanitize and escape the URL field in its settings, potentially allowing high-privilege users to perform Stored Cross-Site Scripting attacks. This vulnerability can be exploited even when the unfiltered html capability is disallowed, such as in a multisite setup.

Recommendations For versions 1.5.4 and earlier, as a temporary workaround, consider disabling the URL field in the plugin settings until a patch is available. Restrict access to the plugin's settings to minimize the risk of exploitation. Avoid using the URL field in the affected plugin settings until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-2009

Affected Products

Pretty Url

References · 6

• 🔥 https://wpscan.com/vulnerability/f7988a18-ba9d-4ead-82c8-30ea8223846f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-2009 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2009 · Vendor Advisory
• https://t.me/cvenotify/50442 · Telegram Post
• https://t.me/cvenotify/50993 · Telegram Post
• https://t.me/cibsecurity/64121 · Telegram Post