Medium severity4.8NVD Advisory· Published May 15, 2023· Updated Jun 17, 2026

CVE-2023-2009

Description

Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Pretty Url/Pretty Urldescription
WordPress/Pretty URLllm-fuzzy
Range: <=1.5.4
Package: https://wordpress.org/plugins/pretty-url

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/f7988a18-ba9d-4ead-82c8-30ea8223846fnvdExploit

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000