PT-2010-5478 · WordPress · Register Plus

Published 2010-12-04 · Updated 2018-10-10 · CVE-2010-4402

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Register Plus plugin versions 3.5.1 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters in a register action, including firstname, lastname, website, aim, yahoo, jabber, about, pass1, and pass2. This can occur in the wp-login.php file.

Recommendations For Register Plus plugin versions 3.5.1 and earlier, update to a version later than 3.5.1 to resolve the issue. As a temporary workaround, consider restricting access to the register action in wp-login.php to minimize the risk of exploitation. Avoid using the vulnerable parameters in the register action until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-4402

Affected Products

Register Plus

References · 8

• 🔥 http://packetstormsecurity.org/files/view/96143/registerplus-xss.txt · Exploit
• 🔥 http://websecurity.com.ua/4539 · Exploit
• http://secunia.com/advisories/42360 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-4402 · Security Note
• http://osvdb.org/69491 · Note
• http://securityfocus.com/archive/1/514903/100/0/threaded · Note
• http://securityfocus.com/bid/45057 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4402 · Note