CVE-2024-11405: WP Front-end login and register <= 2.1.0 - Reflected Cross-Site Scripting
The WP Front-end login and register plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the email and wpmpresetpasswordtoken parameters in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11405?
CVE-2024-11405 has a moderate severity due to its potential for reflected cross-site scripting attacks.
How do I fix CVE-2024-11405?
To resolve CVE-2024-11405, update the WP Front-end login and register plugin to version 2.1.1 or later.
What is the impact of CVE-2024-11405?
CVE-2024-11405 can potentially allow attackers to execute arbitrary JavaScript code in the context of the victim's browser session.
Which versions are affected by CVE-2024-11405?
CVE-2024-11405 affects all versions of the WP Front-end login and register plugin up to and including 2.1.0.
What are the main parameters involved in CVE-2024-11405?
CVE-2024-11405 exploits the email and wpmp_reset_password_token parameters due to lack of input sanitization.