WordPress Plugin Vulnerabilities

Pie Register < 3.7.0.1 - Reflected Cross-Site Scripting (XSS)

Description

The plugin does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue.

Proof of Concept

Affects Plugins

Plugin icon
pie-register
Fixed in 3.7.0.1

References

CVE
CVE-2021-24239
URL
https://plugins.trac.wordpress.org/changeset/2507536/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
iohex
Submitter
iohex
Submitter twitter
iohehe
Verified
Yes
WPVDB ID
f1b67f40-642f-451e-a67a-b7487918ee34

Timeline

Publicly Published
2021-04-03 (about 4 years ago)
Added
2021-04-03 (about 4 years ago)
Last Updated
2021-04-04 (about 4 years ago)

Other

Published
Title
Published
2024-09-12
Title
Tweaker5 <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode
Published
2021-02-08
Title
Contact Form by Supsystic < 1.7.7 - Authenticated Stored Cross-Site Scripting (XSS)
Published
2023-06-21
Title
WooCommerce Pre-Orders < 2.0.1 - Contributor+ Stored XSS
Published
2021-07-21
Title
Maintenance < 4.03 - Authenticated Stored XSS
Published
2015-02-22
Title
Image Metadata Cruncher - Multiple Cross-Site Scripting (XSS)