LiveActive security incident?Get immediate response
CVE Record

CVE-2019-25147: Pretty Links <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via track_link

The Pretty Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various IP headers as well as the referer header in versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping in the track_link function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

HighCVSS 7.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Older Pretty Links WordPress sites can store attacker-supplied script data from request headers during link tracking. If someone later opens the affected plugin page or stored record, that script may run in their browser, creating account, content, or site-management risk.

Executive priority

Treat this as a high-priority plugin update for any WordPress site using Pretty Links link tracking. It can affect administrators without attacker authentication, but sources do not confirm active exploitation.

Technical view

Pretty Links through version 2.1.9 lacks sufficient sanitization and output escaping in track_link. Unauthenticated network requests can place script content in IP-related headers or the Referer header, producing stored cross-site scripting. CVSS is 7.2 with no privileges or user interaction required by the attacker.

Likely exposure

Exposure is likely limited to WordPress sites running Pretty Links version 2.1.9 or earlier with link tracking reachable publicly. Sites not using the plugin, using newer vendor-supported versions, or without affected tracking paths are not shown as affected by the provided sources.

Exploitation context

The source bundle does not show CISA KEV listing or confirmed active exploitation. The risk is still serious because the attack is unauthenticated and stored, so one malicious request can persist until the stored record is cleaned or no longer rendered.

Researcher notes

The affected function is track_link, with tainted values coming from IP-related request headers and Referer. The core flaw is CWE-79: stored XSS from insufficient input sanitization and output escaping. The provided CPE data appears incomplete, so validate by plugin slug and version.

Mitigation direction

  • Upgrade Pretty Links to a vendor-supported version newer than 2.1.9.
  • Review vendor guidance and release notes for the fixed version and cleanup advice.
  • Restrict administrative access and avoid viewing suspicious tracking records before remediation.
  • Purge or sanitize stored tracking records suspected of containing unsafe header data.
  • Use a WordPress security control to monitor suspicious header-based XSS attempts.

Validation and detection

  • Inventory WordPress sites for the Pretty Links plugin and installed version.
  • Confirm no production instance is running Pretty Links 2.1.9 or earlier.
  • Review plugin tracking records for abnormal Referer or IP-header values.
  • Test affected pages after upgrade to confirm stored scripts no longer render.
  • Check access logs for unusual requests to Pretty Links tracking endpoints.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-79: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2019-25147 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.2 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.2CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N3.92.7Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.2High
CVSS 3.1 vector shape for CVE-2019-25147Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
supercleansePrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin0unaffected
Weakness

CWE details

CWE-79

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-79 · source CWE mapping

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs