CVE-2021-24654
Assigner: WPScan
Published: 2021-10-04T11:20:17
State: PUBLISHED
affected: product: User Registration – Custom Registration Form, Login And User Profile For WordPress
vendor: Unknown
versions: lessThan: 2.0.2
status: affected
version: 2.0.2
versionType: custom
credits: value: AyeCode Ltd
descriptions: value: The User Registration WordPress plugin before 2.0.2 does not properly sanitise the user_registration_profile_pic_url value when submitted directly via the user_registration_update_profile_details AJAX action. This could allow any authenticated user, such as subscriber, to perform Stored Cross-Site attacks when their profile is viewed
problemTypes: descriptions: cweId: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
type: CWE
source: discovery: EXTERNAL
title: User Registration < 2.0.2 - Low Privilege Stored Cross-Site Scripting
x_generator: WPScan CVE Generator