Shortlinks by Pretty Links < 3.6.3 - Reflected Cross-Site Scripting via post_status

2024-03-2800:00:00

wpscan.com

plugin

reflected cross-site scripting

post_status

security vulnerability

admin users

6.3 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

Description The plugin does not sanitise and escape the post_status parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CPENameOperatorVersion
eq3.6.3

CPE	Name	Operator	Version
		eq	3.6.3

References

patchstack.com/database/vulnerability/pretty-link/wordpress-pretty-links-plugin-3-6-2-reflected-cross-site-scripting-xss-vulnerability