CVE-2019-14470: WordPress UserPro plugin reflected XSS via error_description parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityThe CVSS score is only medium, but public exploit code exists and EPSS is very high (0.83, 99.7th percentile), making near-term exploitation plausible.

What it is

The cosenary Instagram-PHP-API library bundled with the UserPro WordPress plugin through 4.9.32 reflects the error_description parameter in example/success.php without proper output encoding. An attacker who can lure a victim to a crafted URL can execute script in the victim's browser in the context of the affected site. The flaw is a reflected cross-site scripting issue (CWE-79) rated CVSS 3.0 6.1 (Medium).

Impact

An attacker can run arbitrary JavaScript in a victim's browser session on the WordPress site, enabling session theft, credential phishing, or actions performed as the victim. Because the CVSS scope is changed (S:C), impact can extend beyond the vulnerable component.

Attack surface

Reached over the network through a crafted URL targeting example/success.php with a malicious error_description value. No authentication is required (PR:N), but the victim must be induced to click the link or load the page (UI:R).

Exploitation

Not listed in CISA KEV, but public exploit references exist (Exploit-DB 47304 and Packet Storm) and EPSS is very high at 0.83 (99.7th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Update the UserPro plugin to a version later than 4.9.32, or update the bundled cosenary Instagram-PHP-API library to a fixed commit.
• If patching is not immediately possible, remove or restrict access to example/success.php and other example scripts shipped with the library.
• Apply output encoding for the error_description parameter and validate/whitelist its expected values.
• Deploy a WAF rule to block script payloads in the error_description parameter on affected paths.
• Audit the site for other bundled third-party libraries with similar unpatched example scripts.

Detection

• Search web server logs for requests to example/success.php containing script tags or encoded script payloads in the error_description parameter.
• Monitor for reflected XSS indicators such as alert(), document.cookie, or event handler strings in query parameters hitting WordPress endpoints.
• Review WordPress plugin inventory and file integrity for UserPro versions at or below 4.9.32 and the presence of example/success.php.
• Correlate outbound or anomalous admin session activity following visits to crafted URLs from external referrers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.