CVE-2023-2009
15.05.2023, 13:15
Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
| Vendor | Product | Version |
|---|---|---|
| pretty_url_project | pretty_url | 𝑥 ≤ 1.5.4 |
𝑥
= Vulnerable software versions