CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4958 – User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.2.0.1 - Missing Authorization to Privilege Escalation
https://notcve.org/view.php?id=CVE-2024-4958
The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'import_form_action' function in versions up to, and including, 3.2.0.1. This makes it possible for authenticated attackers, with contributor-level permissions and above, to import a registration form with a default user role of administrator. If an administrator approves or publishes a post or page with the shortcode to the imported form, any user can register as an administrator. El complemento User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin para WordPress es vulnerable a modificaciones no autorizadas de datos debido a una falta de verificación de capacidad en la función 'import_form_action' en versiones hasta la 3.2.0.1 incluida. Esto hace posible que atacantes autenticados, con permisos de nivel de colaborador y superiores, importen un formulario de registro con una función de usuario predeterminada de administrador. • https://plugins.trac.wordpress.org/changeset/3095484/user-registration/tags/3.2.1/includes/class-ur-ajax.php https://www.wordfence.com/threat-intel/vulnerabilities/id/710574a8-a6e2-4ee6-9ea7-03a34994fec7?source=cve • CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-2417 – User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
https://notcve.org/view.php?id=CVE-2024-2417
The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the form_save_action() function in all versions up to, and including, 3.1.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the registration form and make the default registration role administrator. This subsequently allows the attacker to register an account as an administrator on the site. El complemento User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin para WordPress es vulnerable a la escalada de privilegios debido a una falta de verificación de capacidad en la función form_save_action() en todas las versiones hasta la 3.1.5 incluida. Esto hace posible que los atacantes autenticados, con acceso de nivel de suscriptor y superior, actualicen el formulario de registro y conviertan el rol de registro predeterminado en administrador. • https://github.com/wpeverest/user-registration/commit/d265273aa4dddb24ade929be78c6bf1766f1cf00 https://plugins.trac.wordpress.org/changeset/3070439/user-registration/trunk/includes/class-ur-ajax.php https://www.wordfence.com/threat-intel/vulnerabilities/id/d03459d8-b1f2-4270-a294-403754db1f2f?source=cve • CWE-862: Missing Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-3295 – User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion
https://notcve.org/view.php?id=CVE-2024-3295
The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the profile_pic_remove function in versions up to, and including, 3.1.5. This makes it possible for unauthenticated attackers to delete any media file. El complemento User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin para WordPress es vulnerable a la pérdida no autorizada de datos debido a una falta de verificación de capacidad en la función perfil_pic_remove en versiones hasta la 3.1.5 incluida. Esto hace posible que atacantes no autenticados eliminen cualquier archivo multimedia. • https://plugins.trac.wordpress.org/browser/user-registration/tags/3.1.5/includes/class-ur-ajax.php#L1111 https://plugins.trac.wordpress.org/browser/user-registration/trunk/includes/class-ur-ajax.php?rev=3070439#L1115 https://plugins.trac.wordpress.org/changeset/3070439 https://www.wordfence.com/threat-intel/vulnerabilities/id/864a3444-0479-4b9f-beca-584a4a9b8682?source=cve • CWE-862: Missing Authorization •
CVSS: 4.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1720 – User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.4 - Unauthenticated Stored Self-Based Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-1720
The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability requires social engineering to successfully exploit, and the impact would be very limited due to the attacker requiring a user to login as the user with the injected payload for execution. El complemento User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin para WordPress es vulnerable a Cross-Site Scripting Almacenado a través del parámetro 'Nombre para mostrar' en todas las versiones hasta la 3.1.4 incluida debido a una entrada insuficiente sanitización y escape de producción. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en páginas que se ejecutarán cada vez que un usuario acceda a una página inyectada. • https://plugins.trac.wordpress.org/browser/user-registration/trunk/includes/class-ur-shortcodes.php#L288 https://plugins.trac.wordpress.org/changeset/3045419/user-registration/trunk/includes/class-ur-shortcodes.php https://www.wordfence.com/threat-intel/vulnerabilities/id/62b809dc-4089-4822-8aeb-7049fcfe376e?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-5228 – User Registration < 3.0.4.2 - Admin+ Stored XSS
https://notcve.org/view.php?id=CVE-2023-5228
The User Registration WordPress plugin before 3.0.4.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). El complemento User Registration de WordPress anterior a 3.0.4.2 no sanitiza ni escapa a algunas de sus configuraciones, lo que podría permitir a usuarios con altos privilegios, como el administrador, realizar ataques de Cross-Site Scripting (XSS) Almacenado incluso cuando la capacidad unfiltered_html no está permitida (por ejemplo, en una configuración multisitio). The User Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. • https://wpscan.com/vulnerability/50ae7008-46f0-4f89-ae98-65dcabe4ef09 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •