WordPress Login_Register Plugin Cross-Site Request Forgery to Stored Cross-Site Scripting Vulnerability

A vulnerability allowing Cross-Site Request Forgery (CSRF) to Stored Cross-Site Scripting (XSS) has been identified in the WordPress Login_Register plugin, affecting all versions through 1.2.0. The issue arises from a lack of nonce validation on the settings page, combined with inadequate input sanitization and output escaping for the 'login_register_login_post' parameter. This vulnerability enables unauthenticated attackers to inject arbitrary web scripts into pages, which will execute when a user accesses the compromised page via a forged request, provided they can persuade an administrator to perform a specific action, such as clicking a link.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery to Stored Cross-Site Scripting, where injected scripts are executed in the context of the user viewing the affected page.

Remediation

No known patch is available. It is recommended to review the vulnerability details and consider uninstalling the affected plugin.