Pie Register < 3.7.0.1 - Reflected Cross-Site Scripting (XSS)
CVE-2021-24239

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
Pie Register – User Registration Forms. Invitation Based Registrations, Custom Login, Payments
Vendor
CVE Published:
22 April 2021

What is CVE-2021-24239?

The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue.

Affected Version(s)

Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments 3.7.0.1

References

https://wpscan.com/vulnerability/f1b67f40-642f-451e-a67a-...
x_refsource_CONFIRM
https://plugins.trac.wordpress.org/changeset/2507536/
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

iohex
.