CVE-2010-4402
Last modified
CVE-2010-4402 is a vulnerability of currently unknown severity. Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) firstname, (2) lastname, (3) website, (4) aim, (5) yahoo, (6) jabber, (7) about, (8) pass1, and (9) pass2 parameters in a register action.. EPSS estimates a 2.14% chance of exploitation in the next 30 days.
Description
Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) firstname, (2) lastname, (3) website, (4) aim, (5) yahoo, (6) jabber, (7) about, (8) pass1, and (9) pass2 parameters in a register action.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Devbits | Register-Plus | <= 3.5.1 |
| Devbits | Register-Plus | 1.1 |
| Devbits | Register-Plus | 1.2 |
| Devbits | Register-Plus | 2.0 |
| Devbits | Register-Plus | 2.1 |
| Devbits | Register-Plus | 2.2 |
| Devbits | Register-Plus | 2.3 |
| Devbits | Register-Plus | 2.4 |
| Devbits | Register-Plus | 2.5 |
| Devbits | Register-Plus | 2.6 |
| Devbits | Register-Plus | 2.7 |
| Devbits | Register-Plus | 2.8 |
| Devbits | Register-Plus | 2.9 |
| Devbits | Register-Plus | 3.0 |
| Devbits | Register-Plus | 3.0.1 |
| Devbits | Register-Plus | 3.0.2 |
| Devbits | Register-Plus | 3.1 |
| Devbits | Register-Plus | 3.2 |
| Devbits | Register-Plus | 3.3 |
| Devbits | Register-Plus | 3.4 |
| Devbits | Register-Plus | 3.4.1 |
| Devbits | Register-Plus | 3.5 |
References
- http://secunia.com/advisories/42360Vendor Advisory
- http://secunia.com/advisories/42360Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2010-4402?
How severe is CVE-2010-4402?
How do I fix CVE-2010-4402?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2010
- CVE-2010-4396Cross-zone scripting vulnerability in the HandleAction metho…
- CVE-2010-4397Integer overflow in the pnen3260.dll module in RealNetworks …
- CVE-2010-4398Stack-based buffer overflow in the RtlQueryRegistryValues fu…7.8
- CVE-2010-4399Directory traversal vulnerability in languages.inc.php in Dy…
- CVE-2010-4400SQL injection vulnerability in _rights.php in DynPG CMS 4.2.…
- CVE-2010-4401languages.inc.php in DynPG CMS 4.2.0 allows remote attackers…
- CVE-2010-4403The Register Plus plugin 3.5.1 and earlier for WordPress all…
- CVE-2010-4404SQL injection vulnerability in the Yannick Gaultier sh404SEF…
- CVE-2010-4405Cross-site scripting (XSS) vulnerability in the Yannick Gaul…
- CVE-2010-4406Directory traversal vulnerability in gallery.php in Brunetto…
- CVE-2010-4407Multiple cross-site scripting (XSS) vulnerabilities in index…
- CVE-2010-4408Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 thr…
Are you affected by CVE-2010-4402?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST