CVE-2019-25147: 
WordPress vulnerability analysis and mitigation

The Pretty Links WordPress plugin (versions up to 2.1.9) was identified with a Stored Cross-Site Scripting (XSS) vulnerability tracked as CVE-2019-25147. The vulnerability was discovered on June 12, 2019, and publicly disclosed on June 19, 2019. The security flaw exists in the track_link function where various IP headers and the referer header are insufficiently sanitized, affecting over 200,000 active installations (NinTechNet Blog).

The vulnerability stems from the tracklink() function in the app/models/PrliUtils.php script, which retrieves user input for statistical purposes including HTTPREFERER, REQUESTURI, HTTPUSERAGENT, and user IP without proper validation or sanitization. The getcurrentclientip() function retrieves IP addresses from multiple untrusted sources including HTTPCLIENTIP, HTTPXFORWARDEDFOR, HTTPXFORWARDED, HTTPFORWARDEDFOR, and HTTPFORWARDED headers. The CVSS v3.1 score is 7.2 (High) according to Wordfence's assessment (Wordfence Advisory).

When administrators access the 'Pretty Links > Clicks' page to view statistics, the unsanitized IP and HTTP_REFERER values are displayed in the dashboard. This allows attackers to inject malicious JavaScript code that executes in the administrator's browser session, potentially leading to remote code execution. Additionally, the vulnerability can be exploited through CSV injection when exporting data, enabling offline attacks through malicious formulas in spreadsheet applications (NinTechNet Blog).

Users should update to a version newer than 2.1.9 immediately. As an additional security measure, implementing Content-Security-Policy (CSP) directives in the WordPress backend can help prevent the execution of injected JavaScript code. The vulnerability was patched by implementing proper input validation and output escaping in the tracklink function ([WordPress Patch](https://plugins.trac.wordpress.org/changeset?sfpemail=&sfphmail=&reponame=&new=2108490%40pretty-link%2Ftrunk&old=2078274%40pretty-link%2Ftrunk&sfpemail=&sfph_mail=)).