Security readout for executives and security teams
Plain-English summary
CVE-2019-19541 is a stored cross-site scripting issue in the WordPress ListingPro theme before v2.0.14.2. A malicious value entered in the Best Day/Night field on the new listing submission page could persist and later run in another user’s browser.
Executive priority
Treat as a targeted web integrity and session-risk issue, not a confirmed emergency. Prioritize internet-facing ListingPro sites that accept public listing submissions, then upgrade or restrict exposure.
Technical view
The issue is persistent XSS in ListingPro before v2.0.14.2, tied to insufficient handling of the Best Day/Night field on the new listing submit page. The source bundle does not provide CVSS, CWE, privilege requirements, or exact rendering context.
Likely exposure
Exposure is most likely on WordPress sites running ListingPro versions earlier than v2.0.14.2, especially where front-end listing submissions are enabled or reachable by untrusted users.
Exploitation context
The source bundle does not report active exploitation, and CISA KEV status is false. Public information identifies the vulnerable field and affected version range, but does not include exploit prevalence or attack complexity.
Researcher notes
Evidence is limited to the CVE description and WPVulnDB reference. No CVSS, CWE, exploit status, or detailed patch notes are included in the provided bundle, so validation should focus on version, route exposure, and stored-content review.
Mitigation direction
- Upgrade ListingPro to v2.0.14.2 or later where applicable.
- Check ListingPro vendor guidance for current supported fixes.
- Restrict public listing submissions until the theme is confirmed fixed.
- Review submitted listings for suspicious Best Day/Night field content.
Validation and detection
- Inventory WordPress sites using the ListingPro theme.
- Confirm installed ListingPro versions are not earlier than v2.0.14.2.
- Identify whether the new listing submit page is publicly reachable.
- Review application logs and listing records for unusual script-like content.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-19541 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpvulndb.com/vulnerabilities/9974CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.