CVE-2026-94154

Name of the Vulnerable Software and Affected Versions Aurora Heatmap versions prior to 1.7.3

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. By manipulating the url parameter, an attacker can inject arbitrary web scripts into pages that execute when an administrator clicks the injected heatmap link.

Recommendations Update Aurora Heatmap to a version newer than 1.7.2. Avoid using the url parameter in the plugin until the update is applied.