CVE-2026-94154: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in r3098 Aurora Heatmap

CVE-2026-94154 describes a stored Cross-Site Scripting vulnerability in the Aurora Heatmap plugin for WordPress, affecting all versions up to and including 1.7.2. The vulnerability is due to improper neutralization of input during web page generation, specifically in the 'url' parameter. An unauthenticated attacker can inject arbitrary scripts that execute in the context of an admin user when interacting with the heatmap link. The CVSS 3.1 base score is 6.1, indicating a medium severity with network attack vector, low attack complexity, no privileges required, but requires user interaction and impacts confidentiality and integrity with no availability impact.

Successful exploitation can lead to execution of arbitrary scripts in the context of an admin user, potentially compromising confidentiality and integrity of the affected system. However, the attack requires user interaction (admin clicking the malicious link) and does not affect availability.

No official patch or fix is currently documented. Users should monitor the vendor advisory for updates. Until a fix is available, avoid clicking untrusted heatmap links and consider restricting access to the plugin's functionality to trusted users only.