CVE Database /
CVE-2019-25147
CVE · High
CVE-2019-25147 — PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links [pretty-link] < 2.1.10
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2019-25147
|
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links [pretty-link] < 2.1.10 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
High
7.2
|
< 2.1.10
|
2.1.10 |
2019-06-19 |
—
|
CVE-2019-25147
The Pretty Links plugin for WordPress through version 2.1.9 contains a stored cross-site scripting vulnerability in the track_link function where IP headers and referer headers are not adequately sanitized or escaped. Unauthenticated attackers can exploit this weakness to inject malicious scripts that execute when users access pages containing the injected content. The vulnerability affects all versions up to and including 2.1.9, with the flaw remedied in version 2.1.10.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings