CVE-2019-25147

MEDIUM 6.1CVE-2019-25147 · Published 07/06/2023 · updated 17/06/2026

In short

CVE-2019-25147 is a MEDIUM (CVSS 6.1) vulnerability affecting pretty links (prettylinks).
Chance of exploitation in the next 30 days (EPSS): 0.75%, higher than 55.2% of all vulnerabilities.
Fix: update to 2.1.10 or later.

Package	Affected versions	Patched versions
pretty links prettylinks	`< 2.1.10`	`2.1.10`

Description

The Pretty Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various IP headers as well as the referer header in versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping in the track_link function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

References

blog.nintechnet.com/stored-xss-and-csv-injection-vulnerabilities-in-wordpress-shortlinks-by-pretty-links-plugin · Exploit
plugins.trac.wordpress.org/changeset · Patch
wordfence.com/threat-intel/vulnerabilities/id/ae058c5b-b90b-4a1e-9f56-d56dbd2d3607 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free