VRDA Feed by JPCERT/CC
  Vulnerability Response Decision Assistance Feed : Information for vulnerability impact analysis
[ about VRDA Feed | JPCERT/CC ] 



 
Vulnerability Analysis Result (Revision No : 1) [ Download XML ] 
CVE-2010-4402
register_plus_plugin: Multiple cross-site scripting (XSS) vulnerabilities...
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4402

Original

Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) firstname, (2) lastname, (3) website, (4) aim, (5) yahoo, (6) jabber, (7) about, (8) pass1, and (9) pass2 parameters in a register action.

Translation   (Show)





About This Analysis Information
Analysis Information Provider:
NIST NVD
First Published:
2010-12-06
Source Information Category:
Advisory, Alert
Last Updated:
2010-12-06




Affected Product Tags
cpe:/a:wordpress:register_plus_plugin:1.1
cpe:/a:wordpress:register_plus_plugin:1.2
cpe:/a:wordpress:register_plus_plugin:2.0
cpe:/a:wordpress:register_plus_plugin:2.1
cpe:/a:wordpress:register_plus_plugin:2.2
cpe:/a:wordpress:register_plus_plugin:2.3
cpe:/a:wordpress:register_plus_plugin:2.4
cpe:/a:wordpress:register_plus_plugin:2.5
cpe:/a:wordpress:register_plus_plugin:2.6
cpe:/a:wordpress:register_plus_plugin:2.7
cpe:/a:wordpress:register_plus_plugin:2.8
cpe:/a:wordpress:register_plus_plugin:2.9
cpe:/a:wordpress:register_plus_plugin:3.0
cpe:/a:wordpress:register_plus_plugin:3.0.1
cpe:/a:wordpress:register_plus_plugin:3.0.2
cpe:/a:wordpress:register_plus_plugin:3.1
cpe:/a:wordpress:register_plus_plugin:3.2
cpe:/a:wordpress:register_plus_plugin:3.3
cpe:/a:wordpress:register_plus_plugin:3.4
cpe:/a:wordpress:register_plus_plugin:3.4.1
cpe:/a:wordpress:register_plus_plugin:3.5
cpe:/a:wordpress:register_plus_plugin:3.5.1 and previous versions
cpe:/a:wordpress:wordpress
 


Vulnerability Analysis Results
[Access Vector]  [?]
Undefined [?]

Local [?]
Adjacent Network [?]
X Network [?]
[Access Complexit]  [?]
Undefined [?]

High [?]
X Medium [?]
Low [?]
[Authentication]  [?]
Undefined [?]

Multiple [?]
Single [?]
X None [?]
[Confidentiality Impact]  [?]
Undefined [?]

X None [?]
Partial [?]
Complete [?]
[Integrity Impact]  [?]
Undefined [?]

None [?]
X Partial [?]
Complete [?]
[Availability Impact]  [?]
Undefined [?]

X None [?]
Partial [?]
Complete [?]
Alternatives




References
BID 45057




BUGTRAQ 20101125 [Suspected Spam]Vulnerabilities in Register Plus for WordPress




MISC http://websecurity.com.ua/4539




MISC http://packetstormsecurity.org/files/view/96143/registerplus-xss.txt




OSVDB 69491




SECUNIA 42360




Vulnerability Type Cross-Site Scripting (XSS) (CWE-79)




Copyright © 2010 JPCERT/CC All Rights Reserved.