CVE-2019-19134
The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input.
Does this matter?
Lower severity and a low EPSS score (5.73%). Track it; it rarely justifies an emergency change on its own.
Description
The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to inject HTML or arbitrary JavaScript within the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based tokens or to launch other attacks.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 5.73% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- heroplugins/hero maps premium
- Source
- cve@mitre.org
References
- https://heroplugins.com/changelogs/hmaps/changelog.txtRelease Notes, Vendor Advisory
- https://heroplugins.com/product/maps/Product
- https://wpvulndb.com/vulnerabilities/10095Third Party Advisory
- https://www.hooperlabs.xyz/disclosures/cve-2019-19134.phpExploit, Third Party Advisory
- https://heroplugins.com/changelogs/hmaps/changelog.txtRelease Notes, Vendor Advisory
- https://heroplugins.com/product/maps/Product
- https://wpvulndb.com/vulnerabilities/10095Third Party Advisory
- https://www.hooperlabs.xyz/disclosures/cve-2019-19134.phpExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.