Reflected Cross-Site Scripting Vulnerability in WP Front-end Login and Register Plugin for WordPress

CVE-2024-11405

What is CVE-2024-11405?

The WP Front-end Login and Register Plugin for WordPress is susceptible to Reflected Cross-Site Scripting due to inadequate input sanitization and output escaping through the email and wpmp_reset_password_token parameters. This vulnerability can be exploited by unauthenticated attackers to inject arbitrary web scripts into web pages. If users are tricked into interacting with malicious links, these scripts may execute within their browsers, potentially compromising sensitive data and leading to further attacks.

References