Security Advisory

CVE-2023-2009

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2023-05-15 12:15:42

Last updated 2025-01-14 18:25:26

Assigner WPScan

CVSS score 4.8

State PUBLISHED

Description

Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

← Browse all CVEs View on cve.org ↗