CVE-2019-19134

EPSS 5.7%

Vexday Risk Score

18Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 5.7%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

26 Feb 2020Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to inject HTML or arbitrary JavaScript within the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based tokens or to launch other attacks.

Affected products

n/a · n/a

References

https://heroplugins.com/changelogs/hmaps/changelog.txt https://heroplugins.com/product/maps/https://wpvulndb.com/vulnerabilities/10095 https://www.hooperlabs.xyz/disclosures/cve-2019-19134.php