4.8
Medium
CVE-2023-2009 Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could…
Description
Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Pretty Url 1.5 | earliest → 1.5.4 | No fix stated |