Medium severity6.1NVD Advisory· Published Dec 4, 2019· Updated Jun 17, 2026
CVE-2019-19133
CVE-2019-19133
Description
The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary JavaScript in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookies or launch other attacks.
Affected products
2- WordPress/CSS Hero plugindescription
Patches
Vulnerability mechanics
References
3- packetstormsecurity.com/files/155558/WordPress-CSS-Hero-4.0.3-Cross-Site-Scripting.htmlnvdExploitThird Party AdvisoryVDB Entry
- seclists.org/fulldisclosure/2019/Dec/6nvdExploitMailing ListThird Party Advisory
- wpvulndb.com/vulnerabilities/9966nvdThird Party Advisory
News mentions
0No linked articles in our index yet.