CVE-2022-0232

Name of the Vulnerable Software and Affected Versions User Registration, Login & Landing Pages WordPress plugin versions up to and including 1.2.7

Description The issue is related to Stored Cross-Site Scripting due to insufficient escaping via the loader text parameter found in the ~/includes/templates/landing-page.php file. This allows attackers with administrative user access to inject arbitrary web scripts. The issue affects multi-site installations where unfiltered html is disabled for administrators, and sites where unfiltered html is disabled.

Recommendations For versions up to and including 1.2.7, update to a version that includes the necessary security fixes to address the insufficient escaping of the loader text parameter. As a temporary workaround, consider restricting access to the ~/includes/templates/landing-page.php file or disabling the use of the loader text parameter until a patch is available.