Aurora Heatmap EUVD-2026-94651

Exploitation requires an attacker to inject a payload via the plugin's 'url' parameter (no authentication needed, per PR:N), and crucially requires an administrator to subsequently click the injected heatmap link for the stored script to execute (UI:R). The primary limiting factors are this required admin interaction and the fact that impact is confined to the admin's browser context (information disclosure and limited integrity, no availability impact); the site must be running Aurora Heatmap version 1.7.2 or earlier.

This is a stored XSS (CWE-79) in the Aurora Heatmap WordPress plugin with a provided CVSS 3.1 score of 6.1 (vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The signals point to a moderate, not critical, priority. On the elevating side: the attack is network-based (AV:N), low-complexity (AC:L), requires no privileges (PR:N, i.e. unauthenticated injection), and has a changed scope (S:C) because the injected script executes in the privileged admin's browser context rather than the vulnerable component itself. On the mitigating side: successful execution depends on user interaction (UI:R) - specifically an admin clicking the injected heatmap link - and impact is limited (C:L/I:L/A:N), typical of XSS rather than direct server compromise. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active exploitation or automated weaponization; per the data, no public exploit is identified at time of analysis. There is no SSVC decision data supplied. The CVSS vector and the description are internally consistent (unauthenticated remote injection, admin-triggered execution), so no conflict to flag. Net: a legitimate issue worth patching promptly on affected sites, but absent exploitation evidence it is not an emergency relative to unauthenticated RCE-class flaws.

An unauthenticated attacker submits a crafted value in the 'url' parameter that is stored without sufficient sanitization or output escaping. When a logged-in administrator later views the affected page and clicks the injected heatmap link, the malicious script executes in the admin's authenticated browser session, enabling actions such as session/cookie theft or admin-context requests. No public exploit code was identified in the provided data.