CVE-2010-4402 Register Plus <= 3.5.11 - Stored Cross-Site Scripting
MediumCVSS 4.3
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) firstname, (2) lastname, (3) website, (4) aim, (5) yahoo, (6) jabber, (7) about, (8) pass1, and (9) pass2 parameters in a register action.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress register-plus(WordPress) | <= 3.5.11 | No fix listed |
| devbits register-plus | <= 3.5.1 | No fix listed |
| devbits register-plus | = 1.1 | No fix listed |
| devbits register-plus | = 1.2 | No fix listed |
| devbits register-plus | = 2.0 | No fix listed |
| devbits register-plus | = 2.1 | No fix listed |
| devbits register-plus | = 2.2 | No fix listed |
| devbits register-plus | = 2.3 | No fix listed |
| devbits register-plus | = 2.4 | No fix listed |
| devbits register-plus | = 2.5 | No fix listed |
| devbits register-plus | = 2.6 | No fix listed |
| devbits register-plus | = 2.7 | No fix listed |
| devbits register-plus | = 2.8 | No fix listed |
| devbits register-plus | = 2.9 | No fix listed |
| devbits register-plus | = 3.0 | No fix listed |
| devbits register-plus | = 3.0.1 | No fix listed |
| devbits register-plus | = 3.0.2 | No fix listed |
| devbits register-plus | = 3.1 | No fix listed |
| devbits register-plus | = 3.2 | No fix listed |
| devbits register-plus | = 3.3 | No fix listed |
| devbits register-plus | = 3.4 | No fix listed |
| devbits register-plus | = 3.4.1 | No fix listed |
| devbits register-plus | = 3.5 | No fix listed |
References
- Wordfence Intelligence third-party-advisory
- www.cve.org
- 69491 vdb-entry
- packetstormsecurity.org exploit
- 42360 third-party-advisory vendor-advisory
- websecurity.com.ua exploit
- 20101125 [Suspected Spam]Vulnerabilities in Register Plus for WordPress mailing-list
- 45057 vdb-entry