Pretty Url - XSS (CVE-2023-2009)
Description
Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
psychologyCrowdSec Analysis
CVE-2023-2009 is a vulnerability in the Pretty Url WordPress plugin up to version 1.5.4 that allows high-privilege users to inject malicious scripts via the URL field, leading to stored cross-site scripting (XSS) attacks. This flaw can be exploited even when the unfiltered_html capability is disabled, posing a risk in environments like WordPress multisite setups. Attackers could leverage this vulnerability to execute arbitrary JavaScript in the context of other users, potentially leading to session hijacking or data theft.
CrowdSec has been tracking this vulnerability and its exploits since 15th of December 2023.
CrowdSec has not observed any significant exploitation activity targeting CVE-2023-2009 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the Pretty Url WordPress plugin by sending XSS-payloads to certain query parameters of the /wp-admin/admin.php endpoint.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2023-05-15 |
| Rule Released | 2023-12-15 |