CVE-2021-24654: User Registration < 2.0.2 - Low Privilege Stored Cross-Site Scripting
The User Registration WordPress plugin before 2.0.2 does not properly sanitise the userregistrationprofilepicurl value when submitted directly via the userregistrationupdateprofiledetails AJAX action. This could allow any authenticated user, such as subscriber, to perform Stored Cross-Site attacks when their profile is viewed
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24654?
CVE-2021-24654 is a vulnerability in the User Registration WordPress plugin before version 2.0.2 that allows an authenticated user to perform Stored Cross-Site Scripting (XSS) attacks.
How does CVE-2021-24654 impact WordPress?
CVE-2021-24654 allows any authenticated user, such as a subscriber, to inject malicious scripts into the user_registration_profile_pic_url value, leading to potential XSS attacks in WordPress.
What is the severity of CVE-2021-24654?
CVE-2021-24654 has a severity rating of 5.4, which is classified as medium.
How can I fix CVE-2021-24654?
To fix CVE-2021-24654, it is recommended to update the User Registration WordPress plugin to version 2.0.2 or newer.
Where can I find more information about CVE-2021-24654?
More information about CVE-2021-24654 can be found at the following reference: https://wpscan.com/vulnerability/5c7a9473-d32e-47d6-9f8e-15b96fe758f2