Hello list! I want to warn you about multiple Cross-Site Scripting vulnerabilities in plugin Register Plus Redux for WordPress. ------------------------- Affected products: ------------------------- Register Plus Redux is a fork of Register Plus, so many of the holes in it (as from these ones, as from previous ones) are similar to holes in Register Plus. Vulnerable are versions of plugin Register Plus Redux 3.7.3 and previous versions. Version 3.6.1 was checked, but all versions should be vulnerable, because the developer didn't fix any vulnerability (not these ones, nor last year's ones). ---------- Details: ---------- XSS (persistent) (WASC-08): There are many persistent XSS vulnerabilities in plugin options (http://site/wp-admin/options-general.php?page=register-plus-redux) in fields: Enable Password Strength Meter (Short, Bad, Good, Strong) Grace Period, Invitation Code, Disclaimer Title, Disclaimer Content, Agreement Text, License Title, License Content, Agreement Text, Privacy Policy Title, Privacy Policy Content, Agreement Text, Required Field Style Rules, Custom Field, Extra Options, Date Format, First Selectable Date, Default Year, Customize User Notification Email (From Email, From Name, Subject, User Message, Login Redirect URL), Customize Admin Notification Email (From Email, From Name, Subject, Admin Message), Custom Register CSS, Custom Login CSS. The code will execute at plugin options page and/or at registration page (http://site/wp-login.php?action=register). At that at plugin options page the protection against CSRF is used, so it needs to use reflected XSS for bypassing it and conducting of persistent XSS attack. I'll note, that there is persistent XSS in dash_widget.php (as in Register Plus), where the code will execute at visiting of Dashboard page. But widget isn't using in Register Plus Redux, so this attack isn't possible (until the author will not add widget support, because file dash_widget.php is bundled with plugin). ------------ Timeline: ------------ 2011.04.18 - announced at my site. 2011.04.21 - informed developer. 2011.04.22 - informed developer on another e-mail. 2011.08.05 - disclosed at my site. Taking into account, that the author of the plugin didn't fix these holes (as previous ones), then users of the plugin need to fix these holes by themselves. I mentioned about these vulnerabilities at my site (http://websecurity.com.ua/5089/). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua