The version of the Pretty Link Lite plugin for WordPress installed on the remote host fails to properly sanitize user-supplied input to the 'url' parameter of the 'pretty-bar.php' script before using it to generate dynamic HTML output. An attacker can leverage this issue to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site.

Note that the install is also reportedly affected by an additional cross-site scripting issue as well as a SQL injection vulnerability;
however, Nessus has not tested for these.

Detections

Analytics

Pretty Link Plugin for WordPress 'pretty-bar.php' 'url' Parameter XSS

medium Nessus Plugin ID 59387

Version 1.9