Lucene search
Shezad MasterWPEX-ID:F7988A18-BA9D-4EAD-82C8-30EA8223846FHistoryApr 18, 2023 - 12:00 a.m.
Pretty Url <= 1.5.4 - Admin+ Stored XSS in plugin settings
2023-04-1800:00:00
Shezad Master
70
pretty url admin stored xss payload executed reload
EPSS
0.001
Percentile
41.3%
Plugin does not sanitize and escape the URL field in the plugin settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
1. In the "Enter the URL: field, add the XSS payload `<img src=x onerror=alert(1)>` and save
2. Payload will be executed upon reload.Related
prion
prion
Cross site scripting
2023-05-15 13:15:00
wpvulndb
wpvulndb
Pretty Url <= 1.5.4 - Admin+ Stored XSS in plugin settings
2023-04-18 00:00:00
nuclei
nuclei
Pretty Url <= 1.5.4 - Cross-Site Scripting
2023-10-17 07:20:28
nvd
nvd
CVE-2023-2009
2023-05-15 13:15:10
cvelist
cvelist
CVE-2023-2009 Pretty Url <= 1.5.4 - Admin+ Stored XSS in plugin settings
2023-05-15 12:15:42
cve
cve
CVE-2023-2009
2023-05-15 13:15:10
wordfence
wordfence