# CVE-2023-2009: Pretty Url - XSS

> Live exploitation tracking for CVE-2023-2009 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-2009

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 4.8
- **Public exploit available:** Yes
- **Affected products:** N/A Pretty Url
- **Weaknesses:** CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
- **Tags:** cms, wordpress

## Description

Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

## CrowdSec analysis

[CVE-2023-2009](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-2009) is a vulnerability in the Pretty Url WordPress plugin up to version 1.5.4 that allows high-privilege users to inject malicious scripts via the URL field, leading to stored cross-site scripting (XSS) attacks. This flaw can be exploited even when the unfiltered_html capability is disabled, posing a risk in environments like WordPress multisite setups. Attackers could leverage this vulnerability to execute arbitrary JavaScript in the context of other users, potentially leading to session hijacking or data theft.

CrowdSec has been tracking this vulnerability and its exploits since 15th of December 2023.

CrowdSec has not observed any significant exploitation activity targeting CVE-2023-2009 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the Pretty Url WordPress plugin by sending XSS-payloads to certain query parameters of the `/wp-admin/admin.php` endpoint.

## Timeline

- 2023-05-15: CVE Published. CVE-2023-2009 is published to NVD.
- 2023-12-15: Rule Released. CrowdSec releases a rule to detect CVE-2023-2009 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2009.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-2009) follows observed exploitation activity for CVE-2023-2009. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.