Pagerank Tools Stored Cross-Site Scripting Vulnerability via Cross-Site Request Forgery

A stored cross-site scripting vulnerability has been identified in the Pagerank Tools plugin for WordPress, affecting all versions through 1.1.5. The issue arises from inadequate nonce validation in the pr_save_settings() function and poor input sanitization. This vulnerability allows unauthenticated attackers to inject malicious scripts through a forged request, provided they can persuade a site administrator to click a link or perform a similar action. The injected scripts would then execute whenever a user visits the plugin's settings page.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user visiting the settings page.