| |
Vulnerability CVE-2010-4402
Published: 2010-12-06 Modified: 2012-02-13
| Description: |
Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) firstname, (2) lastname, (3) website, (4) aim, (5) yahoo, (6) jabber, (7) about, (8) pass1, and (9) pass2 parameters in a register action. |
See advisories in our WLB2 database: | Topic | Author | Date |
Med. |
| MustLive | 07.12.2010 |
Type:
CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)
| CVSS Base Score |
Impact Subscore |
Exploitability Subscore |
4.3/10 |
2.9/10 |
8.6/10 |
| Exploit range |
Attack complexity |
Authentication |
Remote |
Medium |
No required |
| Confidentiality impact |
Integrity impact |
Availability impact |
None |
Partial |
None |
References: |
http://packetstormsecurity.org/files/view/96143/registerplus-xss.txt
http://websecurity.com.ua/4539
http://www.securityfocus.com/archive/1/514903/100/0/threaded
http://www.securityfocus.com/bid/45057
|
|
|
Copyright 2024, cxsecurity.com
|
|
|
