Description
The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-62467. The attacker could execute JavaScript code in the victim's browser by using the link to preview sites hosted on the server. Authentication is not required to exploit the vulnerability.
Remediation
References
Related Vulnerabilities
WordPress Plugin Easy Forms for Mailchimp Unspecified Vulnerability (6.6.2)
WordPress Plugin 404 SEO Redirection Cross-Site Scripting (1.3)
WordPress Plugin Nmedia WordPress Member Conversation 'doupload.php' Arbitrary File Upload (1.3)
WordPress Plugin Highlight Search Terms Cross-Site Scripting (1.3)
WordPress Plugin All 404 Redirect to Homepage Cross-Site Scripting (1.20)