CVE-2019-14470
UserPro <= 4.9.34 - Reflected Cross-Site Scripting
Severity Score
6.1
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_description parameter.
cosenary Instagram-PHP-API (también se conoce como Instagram PHP API V2), como es usado en el plugin UserPro versiones hasta 4.9.32 para WordPress, presenta una vulnerabilidad de tipo XSS por medio del parámetro error_description del archivo example/success.php.
WordPress UserPro versions 4.9.32 and below suffer from a cross site scripting vulnerability.
*Credits:
Damian Ebelties
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2019-08-01 CVE Reserved
- 2019-08-25 CVE Published
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- 2024-10-02 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| https://github.com/cosenary/Instagram-PHP-API/commits/master | Third Party Advisory | |
| https://wpvulndb.com/vulnerabilities/9815 | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/47304 | 2024-08-05 | |
| http://packetstormsecurity.com/files/154206/WordPress-UserPro-4.9.32-Cross-Site-Scripting.html | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Instagram-php-api Project Search vendor "Instagram-php-api Project" | Instagram-php-api Search vendor "Instagram-php-api Project" for product "Instagram-php-api" | - | - |
Affected
| ||||||
| Userproplugin Search vendor "Userproplugin" | User Pro Search vendor "Userproplugin" for product "User Pro" | <= 4.9.32 Search vendor "Userproplugin" for product "User Pro" and version " <= 4.9.32" | wordpress |
Affected
| ||||||