EUVD-2026-14181
GHSA-p352-rg87-vcp2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The login_register plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.2.0. This is due to missing nonce validation on the settings page and insufficient input sanitization and output escaping on the 'login_register_login_post' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
AnalysisAI
The login_register plugin for WordPress versions up to 1.2.0 contains a combined Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS) vulnerability due to missing nonce validation and insufficient input sanitization on the settings page. Unauthenticated attackers can craft malicious links to trick administrators into injecting arbitrary JavaScript that persists and executes for all users accessing affected pages. While the CVSS score is moderate at 4.3, the vulnerability requires user interaction (administrator click) but enables persistent script injection with potential for credential theft or further compromise.
Technical ContextAI
The vulnerability exists in the login_register plugin (CPE: cpe:2.3:a:frankkoenen:plugin_name:_login_register) maintained by Frank Koenen for WordPress. The root cause is classified under CWE-352 (Cross-Site Request Forgery) combined with insufficient output escaping and input sanitization of the 'login_register_login_post' parameter. The vulnerable code is located in login_register_admin.php at lines 12, 14, and 69 as confirmed by the WordPress plugin repository. The plugin fails to implement WordPress security best practices: it does not validate nonces (WordPress's CSRF protection mechanism) before processing form submissions on the settings page, nor does it properly escape user-controlled input before rendering it to the DOM. This allows attackers to chain CSRF attacks with stored XSS to achieve persistent payload injection.
RemediationAI
Update the login_register plugin to a version newer than 1.2.0 immediately, as the vulnerability affects all versions up to 1.2.0 inclusive. Consult the plugin's official repository or developer for available patched versions. Until a patch is available or applied, site administrators should consider temporarily disabling the login_register plugin or restricting access to the settings page through network controls (IP whitelisting for administrative access). Additionally, implement Content Security Policy (CSP) headers to mitigate the impact of any injected scripts, and ensure all WordPress administrators use strong, unique passwords to reduce the likelihood of account compromise if any scripts target credential harvesting. Review the Wordfence advisory and plugin repository for post-patch release notes: https://www.wordfence.com/threat-intel/vulnerabilities/id/8c82d209-3c69-4d6e-a129-d519f6601540?source=cve.
More in Plugin Name
View allSame weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today