CVE-2019-15482
Cross-Site Scripting in selectize-plugin-a11y
selectize-plugin-a11y before 1.1.0 has XSS via the msg field.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
selectize-plugin-a11y before 1.1.0 has XSS via the msg field.
- Record
CVE-2019-15482- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
selectize-plugin-a11y before 1.1.0 has XSS via the msg field.
- Record
CVE-2019-15482- Updated
- 2026-11-02
EUVDEUVD-2019-0627 No score
selectize-plugin-a11y before 1.1.0 has XSS via the msg field.
- Record
EUVD-2019-0627- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8cpw-73f2-w58m
Cross-Site Scripting in selectize-plugin-a11y
Versions of selectize-plugin-a11y prior to 1.1.0 are vulnerable to Cross-Site Scripting. The accessibility.liveRegion.speak function does not sanitize the msg variable before rendering it as HTML. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in a victim's browser.
Recommendation
Upgrade to version 1.1.0 or later.
- Record
GHSA-8cpw-73f2-w58m- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-8cpw-73f2-w58m
Cross-Site Scripting in selectize-plugin-a11y
Versions of selectize-plugin-a11y prior to 1.1.0 are vulnerable to Cross-Site Scripting. The accessibility.liveRegion.speak function does not sanitize the msg variable before rendering it as HTML. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in a victim's browser.
Recommendation
Upgrade to version 1.1.0 or later.
- Record
GHSA-8cpw-73f2-w58m- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
selectize-plugin-a11ynpm |
before 1.1.0 | 1.1.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-15482 is a medium vulnerability (CVSS 6.1) in Selectize-plugin-a11y Project Selectize-plugin-a11y, published August 23, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.86%, the 58th percentile. Fixed in selectize-plugin-a11y 1.1.0.