CVE-2019-19133

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-12-04 · updated 2026-06-17
Weakness: CWE-79

Description

The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary JavaScript in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookies or launch other attacks.

Affected products

Csshero: 4.0.3

References

http://packetstormsecurity.com/files/155558/WordPress-CSS-Hero-4.0.3-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2019/Dec/6
http://seclists.org/fulldisclosure/2019/Dec/6
http://seclists.org/fulldisclosure/2019/Dec/6
http://seclists.org/fulldisclosure/2019/Dec/6
https://wpvulndb.com/vulnerabilities/9966
http://packetstormsecurity.com/files/155558/WordPress-CSS-Hero-4.0.3-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2019/Dec/6
http://seclists.org/fulldisclosure/2019/Dec/6
http://seclists.org/fulldisclosure/2019/Dec/6
http://seclists.org/fulldisclosure/2019/Dec/6
https://wpvulndb.com/vulnerabilities/9966

Get alerted when CVE-2019-19133 or the next vulnerability affects your stack