The Pretty Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various IP headers as well as the referer header in versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping in the track_link function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2023-06-07T01:51:38.889Z

Updated: 2024-08-05T03:00:19.233Z

Reserved: 2023-06-06T13:09:27.199Z

Link: CVE-2019-25147

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2023-06-07T02:15:10.577

Modified: 2024-11-21T04:39:58.643

Link: CVE-2019-25147

cve-icon Redhat

No data.