Auto Login New User After Registration Vulnerabilities

[en] Cross-Site Request Forgery (CSRF) vulnerability in Jeff Sherk Auto Login New User After Registration allows Stored XSS.This issue affects Auto Login New User After Registration: from n/a through 1.9.6.

Affected:

up to 1.9.6

Fix:

No patched version reported

Disclosed:

Nov 13, 2023

CVE-2023-46201 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Jeff Sherk Auto Login New User After Registration plugin <= 1.9.6 versions.

Affected:

up to 1.9.6

Fix:

No patched version reported

Disclosed:

Oct 24, 2023

CVE-2023-46202 on NVD →

The Auto Login New User After Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alnuar_auto_login_new_user_after_registration_redirect' parameter in all versions up to, and including, 1.9.6 due to insufficient input sanitization and output escaping. This makes it possible for authe...

CVSS:

4.4

Affected:

up to 1.9.6

Fix:

No patched version reported

Disclosed:

Oct 19, 2023

CVE-2023-46201 on NVD →

The Auto Login New User After Registration plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.9.6. This is due to missing or incorrect nonce validation on the alnuar_auto_login_new_user_after_registration_options function. This makes it possible for unauthenticated atta...

CVSS:

4.3

Affected:

up to 1.9.6

Fix:

No patched version reported

Disclosed:

Oct 19, 2023

CVE-2023-46202 on NVD →