The Aurora Heatmap plugin for WordPress stores user‑supplied data in the 'url' parameter without sufficient sanitization or escaping. When an admin later clicks the heatmap link, the injected script is executed with the admin's privileges, potentially allowing theft of credentials, defacement of site content, or further compromise of the system. This reflected behaviour matches the input validation weakness identified by CWE‑79.

All installations of the Aurora Heatmap plugin, version 1.7.2 or earlier. The vulnerability impacts the WordPress platform wherever this plugin is active and the 'url' parameter is used to configure heatmap links.

The vulnerability has a CVSS score of 6.1, placing it in the moderate severity range. No EPSS score is available, and it is not listed in CISA's KEV catalog, suggesting no confirmed exploitation reports at this time. The likely attack vector is a simple unauthenticated HTTP request that submits a malicious URL to the plugin. Once the data is stored, any subsequent admin click triggers the payload, giving attackers a straightforward route to compromise the administration interface and potentially the underlying application.