CVE-2024-1720

Name of the Vulnerable Software and Affected Versions User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin versions up to, and including, 3.1.4

Description The issue is related to Stored Cross-Site Scripting via the Display Name parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploitation of this issue requires social engineering, and its impact is limited because the attacker needs a user to login as the user with the injected payload for execution.

Recommendations For versions up to, and including, 3.1.4, consider updating to a version that addresses the insufficient input sanitization and output escaping issue. As a temporary workaround, restrict the ability to modify the Display Name parameter to prevent potential exploitation.