4.8
Moyenne
CVE-2023-2009 Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could…
Description
Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Pretty Url 1.5 | premières → 1.5.4 | Pas de correctif indiqué |