CVE Feed

    Dashboard / CVE / CVE-2013-4954

    CVE-2013-4954

    Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register plugin before 1.31 for WordPress, when "Allow New Registrations to set their own Password" is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) pass1 or (2) pass2 parameter in a register action. NOTE: some of these details are obtained from third party information.

    Published:Jul 29, 2013
    Last Modified:Apr 11, 2025
    EPS:Jul 29, 2013
    EPSS Score:0.04917
    CVSS Score:2.6

    Affected Products

    Vendor
    Genetechsolutions
    Product
    Pie-register
    Vendor
    Wordpress
    Product
    Wordpress

    Exploits

    http://plugins.trac.wordpress.org/changeset?reponame=&old=740249%40pie-register&new=740249%40pie-registerhttp://www.securityfocus.com/bid/61140http://plugins.trac.wordpress.org/changeset?reponame=&old=740249%40pie-register&new=740249%40pie-registerhttp://www.securityfocus.com/bid/61140https://www.exploit-db.com/exploits/38643

    References

    http://osvdb.org/95160
    http://plugins.trac.wordpress.org/changeset?reponame=&old=740249%40pie-register&new=740249%40pie-register
    http://secunia.com/advisories/54123
    http://wordpress.org/plugins/pie-register/changelog/
    http://wordpress.org/support/topic/security-issue-web-application-cross-site-scripting
    http://www.securityfocus.com/bid/61140
    https://exchange.xforce.ibmcloud.com/vulnerabilities/85604
    http://osvdb.org/95160
    http://plugins.trac.wordpress.org/changeset?reponame=&old=740249%40pie-register&new=740249%40pie-register
    http://secunia.com/advisories/54123
    http://wordpress.org/plugins/pie-register/changelog/
    http://wordpress.org/support/topic/security-issue-web-application-cross-site-scripting
    http://www.securityfocus.com/bid/61140
    https://exchange.xforce.ibmcloud.com/vulnerabilities/85604

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High