CVE-2013-4954
Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie...
CVE-2013-4954 is a low vulnerability (CVSS 2.6) in Genetechsolutions Pie-register, published July 29, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.15%, the 93rd percentile. No source names a fixed version.
- Severity
- 2.6 LowCVSS 2.0, NVD
- Exploit chance
- 6.15%EPSS, 93rd percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register plugin before 1.31 for WordPress, when "Allow New Registrations to set their own Password" is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) pass1 or (2) pass2 parameter in a register action. NOTE: some of these details are obtained from third party information.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | WordPress Plugin Pie Register - 'wp-login.php' Multiple Cross-Site Scripting Vulnerabilities | 2013-07-12 |
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register plugin before 1.31 for WordPress, when "Allow New Registrations to set their own Password" is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) pass1 or (2) pass2 parameter in a register action. NOTE: some of these details are obtained from third party information.
- Record
CVE-2013-4954- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register plugin before 1.31 for WordPress, when "Allow New Registrations to set their own Password" is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) pass1 or (2) pass2 parameter in a register action. NOTE: some of these details are obtained from third party information.
- Record
CVE-2013-4954- Updated
- 2026-11-02
EUVDEUVD-2013-4798No score
Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register plugin before 1.31 for WordPress, when "Allow New Registrations to set their own Password" is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) pass1 or (2) pass2 parameter in a register action. NOTE: some of these details are obtained from third party information.
- Record
EUVD-2013-4798- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jpgx-25w5-rvq8No score
Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie...
Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register plugin before 1.31 for WordPress, when "Allow New Registrations to set their own Password" is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) pass1 or (2) pass2 parameter in a register action. NOTE: some of these details are obtained from third party information.
- Record
GHSA-jpgx-25w5-rvq8- Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
plugins.trac.wordpress.org/changeset?reponame=&old=740249%40pie-register&new=740249%40pie-register
secunia.com/advisories/54123
osvdb.org/95160
securityfocus.com/bid/61140
exchange.xforce.ibmcloud.com/vulnerabilities/85604
wordpress.org/plugins/pie-register/changelog
nvd.nist.gov/vuln/detail/CVE-2013-4954
github.com/advisories/GHSA-jpgx-25w5-rvq8