CVE-2019-7411 - CVE House
Back to Database
Status published Medium CVE-2019-7411

Multiple stored cross-site scripting (XSS) in the MyThemeShop Launcher plugin...

Vulnerability Description

Multiple stored cross-site scripting (XSS) in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via fields as follows: (1) Title, (2) Favicon, (3) Meta Description, (4) Subscribe Form (Name field label, Last name field label, Email field label), (5) Contact Form (Name field label and Email field label), and (6) Social Links (Facebook Page URL, Twitter Page URL, Instagram Page URL, YouTube Page URL, Linkedin Page URL, Google+ Page URL, RSS URL).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-7411

Credits & Attribution

No credits recorded in the NVD database.

References

More from mythemeshop

View All →
CVE-2025-8425
My WP Translate <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
High 8.8
CVE-2025-8423
My WP Translate <= 1.1 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Option Read and Deletion
Medium 5.4
CVE-2025-2158
WordPress Review Plugin: The Ultimate Solution for Building a Review Website <= 5.3.5 - Authenticated (Contributor+) Local File Inclusion via Post Custom Fields
High 8.8
CVE-2017-18569
The my-wp-translate plugin before 1.0.4 for WordPress has CSRF....
High 8.8
CVE-2017-18568
The my-wp-translate plugin before 1.0.4 for WordPress has XSS....
Medium 6.1

Affected Vendor

mythemeshop

View all reports →

Affected Software

launcher
Vulnerable Versions:
1.0.8

Timeline

Official Publish: May 13th, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.