{"error":0,"message":null,"data":{"name":"LoginWP (Formerly Peter's Login Redirect)","plugin":"peters-login-redirect","link":"https:\/\/wordpress.org\/plugins\/peters-login-redirect\/","latest":"1789116720","closed":0,"closed_reason":null,"closed_date":null,"vulnerability":[{"uuid":"096789c4908a6cb322afd875501ea3e4fef1fce62182d2b4572376a8bf7c2b14","name":"LoginWP (Formerly Peter's Login Redirect) [peters-login-redirect] < 3.0.0.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.0.0.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2021-24939","name":"CVE-2021-24939","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2021-24939","description":"[en] The LoginWP (Formerly Peter's Login Redirect) WordPress plugin before 3.0.0.5 does not sanitise and escape the rul_login_url and rul_logout_url parameter before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting issue","date":"2021-12-06"},{"id":"0266358d5d9c0f397abad8977cacd048264c89eb","name":"WordPress LoginWP plugin <= 3.0.0.4 - Reflected Cross-Site Scripting (XSS) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/peters-login-redirect\/vulnerability\/wordpress-loginwp-plugin-3-0-0-4-reflected-cross-site-scripting-xss-vulnerability","description":"Reflected Cross-Site Scripting (XSS) vulnerability discovered by JrXnm in WordPress LoginWP plugin (versions <= 3.0.0.4).","date":"2021-11-08"},{"id":"a9ab0bec4fcb5b3410f280a5334b17b62abf14f8","name":"LoginWP < 3.0.0.5 - Reflected Cross-Site Scripting via rul_login_url, rul_logout_url Parameter","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/peters-login-redirect\/loginwp-3005-reflected-cross-site-scripting-via-rul-login-url-rul-logout-url-parameter","description":"The LoginWP (Formerly Peter's Login Redirect) WordPress plugin before 3.0.0.5 does not sanitise and escape the rul_login_url and rul_logout_url parameter before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting issue","date":"2021-11-08"},{"id":"1a46cfec-24ad-4619-8579-f09bbd8ee748","name":"LoginWP < 3.0.0.5 - Reflected Cross-Site Scripting","link":"https:\/\/wpscan.com\/vulnerability\/1a46cfec-24ad-4619-8579-f09bbd8ee748","description":"The plugin does not sanitise and escape the rul_login_url and rul_logout_url parameter before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting issue","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"6.1","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"cda76e5166455c18837bf598e2b90f330a3c4863d5bb09dfbbc4d2960912efda","name":"LoginWP (Formerly Peter's Login Redirect) [peters-login-redirect] < 2.9.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.9.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2016-10925","name":"CVE-2016-10925","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2016-10925","description":"[en] The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.","date":"2019-08-22"},{"id":"c9b74885d086894e4e8b715f828a5544f18fdcbf","name":"LoginWP < 2.9.1 - Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/peters-login-redirect\/loginwp-291-cross-site-scripting","description":"The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.","date":"2016-08-11"},{"id":"eddbebc8-3546-4e16-a36c-64a1bd27ff70","name":"Peter's Login Redirect <= 2.9.0 - Cross-Site Scripting (XSS) & CSRF","link":"https:\/\/wpscan.com\/vulnerability\/eddbebc8-3546-4e16-a36c-64a1bd27ff70","description":"The Peter's Login Redirect WordPress plugin was affected by a Cross-Site Scripting (XSS) & CSRF security vulnerability.","date":null}],"impact":{"cvss":{"version":"3.0","vector":"CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.0","vector":"CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"6.1","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"632d613b776eff5af491cd120730ac70af9b89fb210f5b399beb545c160d2b0b","name":"LoginWP (Formerly Peter's Login Redirect) [peters-login-redirect] < 2.9.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.9.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2019-15115","name":"CVE-2019-15115","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2019-15115","description":"[en] The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.","date":"2019-08-16"},{"id":"6865bf9cba99993a6d403ec42abd1c96709a8504","name":"LoginWP <= 2.9.1 - Multiple Cross-Site Request Forgery vulnerabilities","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/peters-login-redirect\/loginwp-291-multiple-cross-site-request-forgery-vulnerabilities","description":"The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.","date":"2019-02-23"},{"id":"f7e4c71c-16b1-45cc-ba5b-5960f9d6ec94","name":"Peters Login Redirect <= 2.9.1 - Multiple CSRF","link":"https:\/\/wpscan.com\/vulnerability\/f7e4c71c-16b1-45cc-ba5b-5960f9d6ec94","description":"The Peter's Login Redirect WordPress plugin was affected by a Multiple CSRF security vulnerability.","date":null}],"impact":{"cvss":{"version":"3.0","vector":"CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"n","ui":"r","s":"u","c":"h","i":"h","a":"h","score":"8.8","severity":"h","exploitable":"2.8","impact":"5.9"},"cvss3":{"version":"3.0","vector":"CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H","score":"8.8","severity":"high","av":"network","ac":"low","pr":"none","ui":"required","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"2.8","impact":"5.9"},"cwe":[{"cwe":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor."}]}},{"uuid":"57874c7e1e13dd68f09b53871dcdf5315a9e5d98b201e1110b0b8f13a965c641","name":"LoginWP (Formerly Peter's Login Redirect) [peters-login-redirect] < 2.9.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.9.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"e6e06d918d72f1b0ad7c37fa0bf5f876be50d7e0","name":"WordPress Peter's Login Redirect Plugin <= 2.9.0 - Multiple Vulnerabilities","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/peters-login-redirect\/vulnerability\/wordpress-peter-s-login-redirect-plugin-2-9-0-multiple-vulnerabilities","description":"Because of this vulnerability, the attackers can change any setting of this plugin, steal Administrators' session\r\ntokens or inject arbitrary HTML.\nUpdate this plugin.","date":"2016-08-15"}],"impact":[]}]},"updated":"1776563733"}