A vulnerability was found in Pie Register Plugin up to 2.0.18 on WordPress (WordPress Plugin). It has been declared as problematic. Affected by this vulnerability is an unknown code of the file pie-register/pie-register.php. The manipulation of the argument invitaion_code with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. The summary by CVE is:

Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the invitaion_code parameter in a pie-register page to the default URI.

The weakness was presented 10/16/2015 (Website). It is possible to read the advisory at wpvulndb.com. This vulnerability is known as CVE-2015-7377 since 09/25/2015. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

By approaching the search of inurl:pie-register/pie-register.php it is possible to find vulnerable targets with Google Hacking. The commercial vulnerability scanner Qualys is able to test this issue with plugin 11537 (WordPress Pie-Register Plugin SQL Injection and Cross-Site Scripting Vulnerabilities).

Upgrading to version 2.0.19 eliminates this vulnerability.

See 78534 for similar entry.

Productinfo

Type

• WordPress Plugin

Name

• Pie Register Plugin

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9
• 2.0.10
• 2.0.11
• 2.0.12
• 2.0.13
• 2.0.14
• 2.0.15
• 2.0.16
• 2.0.17
• 2.0.18

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion