Aurora Heatmap
Monthly
Stored cross-site scripting in the Aurora Heatmap WordPress plugin affects all versions up to and including 1.7.2 and lets unauthenticated attackers inject arbitrary JavaScript through the plugin's 'url' parameter, with the payload firing in an administrator's browser whenever that admin clicks the injected heatmap link. The flaw is rated CVSS 3.1 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), meaning no authentication is needed to plant the payload but a successful attack depends on an administrator later interacting with the malicious link; impact is limited to information disclosure and limited integrity within the admin's browser session, with no availability impact. There is no public exploit identified at time of analysis, and the plugin should be treated as untrusted until a fixed build is confirmed. An upstream Trac changeset (3712276) indicates code changes addressing the issue, but no patched release version has been independently confirmed.
Stored cross-site scripting in the Aurora Heatmap WordPress plugin affects all versions up to and including 1.7.2 and lets unauthenticated attackers inject arbitrary JavaScript through the plugin's 'url' parameter, with the payload firing in an administrator's browser whenever that admin clicks the injected heatmap link. The flaw is rated CVSS 3.1 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), meaning no authentication is needed to plant the payload but a successful attack depends on an administrator later interacting with the malicious link; impact is limited to information disclosure and limited integrity within the admin's browser session, with no availability impact. There is no public exploit identified at time of analysis, and the plugin should be treated as untrusted until a fixed build is confirmed. An upstream Trac changeset (3712276) indicates code changes addressing the issue, but no patched release version has been independently confirmed.