Detections
Analytics
Pretty Link Plugin for WordPress 'pretty-bar.php' 'url' Parameter XSS
medium Nessus Plugin ID 59387
Language:
Synopsis
The remote web server hosts a PHP script that is affected by a cross- site scripting vulnerability.Description
The version of the Pretty Link Lite plugin for WordPress installed on the remote host fails to properly sanitize user-supplied input to the 'url' parameter of the 'pretty-bar.php' script before using it to generate dynamic HTML output. An attacker can leverage this issue to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site.Note that the install is also reportedly affected by an additional cross-site scripting issue as well as a SQL injection vulnerability;
however, Nessus has not tested for these.
Solution
Upgrade to Pretty Link Lite 1.5.4 or laterSee Also
https://packetstormsecurity.com/files/107551/wordpressprettylink-xss.txt
Plugin Details
Severity: Medium
ID: 59387
File Name: wordpress_pretty_link_lite_url_xss.nasl
Version: 1.9
Type: remote
Family: CGI abuses : XSS
Published: 6/6/2012
Updated: 6/4/2024
Supported Sensors: Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: Low
Score: 3.8
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:wordpress:wordpress
Required KB Items: installed_sw/WordPress, www/PHP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Patch Publication Date: 12/3/2011
Vulnerability Publication Date: 12/6/2011
Reference Information
CVE: CVE-2011-4595
BID: 53531