The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary JavaScript in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookies or launch other attacks.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/155558/WordPress-CSS-Hero-4.0.3-Cross-Site-Scripting.html | Exploit Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2019/Dec/6 | Exploit Mailing List Third Party Advisory |
| http://seclists.org/fulldisclosure/2019/Dec/6 | Exploit Mailing List Third Party Advisory |
| https://wpvulndb.com/vulnerabilities/9966 | Third Party Advisory |
| http://packetstormsecurity.com/files/155558/WordPress-CSS-Hero-4.0.3-Cross-Site-Scripting.html | Exploit Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2019/Dec/6 | Exploit Mailing List Third Party Advisory |
| http://seclists.org/fulldisclosure/2019/Dec/6 | Exploit Mailing List Third Party Advisory |
| https://wpvulndb.com/vulnerabilities/9966 | Third Party Advisory |
Configurations
History
21 Nov 2024, 04:34
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/155558/WordPress-CSS-Hero-4.0.3-Cross-Site-Scripting.html - Exploit, Third Party Advisory, VDB Entry | |
| References | () http://seclists.org/fulldisclosure/2019/Dec/6 - Exploit, Mailing List, Third Party Advisory | |
| References | () https://wpvulndb.com/vulnerabilities/9966 - Third Party Advisory |
Information
Published : 2019-12-04 19:15
Updated : 2024-11-21 04:34
NVD link : CVE-2019-19133
Mitre link : CVE-2019-19133
CVE.ORG link : CVE-2019-19133
JSON object : View
Products Affected
csshero
- csshero
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')