XSS in WordPress Pretty Link Lite

Posted: November 20, 2012 in Vulnerabilities
Tags: , ,

Wordpress Vulnerability

XSS in WordPress

Vulnerability: XSS in WordPress Pretty Link Lite

Danger: Low
Patch: Yes
Number of vulnerabilities: 1

Vector of operation: Remote
Impact: Cross Site Scripting

Affected products: WordPress Pretty Link Plugin 1.x

Affected versions: WordPress Pretty Link Lite 1.6.0, possibly earlier.

Description:

The vulnerability allows malicious people to conduct XSS attacks.

The vulnerability is caused due to insufficient input validation in the parameter “search” in the script wp-admin/admin.php (when the parameter “page” is “pretty-link”). This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Manufacturer URL: http://blairwilliams.com/pretty-link/

Solution: Install the latest version 1.6.1 from the manufacturer.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s