--- title: CVE-2010-4402 description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2010-4402 --- # CVE-2010-4402 Publication date 6 December 2010 Last updated 24 July 2024 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) Toggle side navigation ## Description Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) firstname, (2) lastname, (3) website, (4) aim, (5) yahoo, (6) jabber, (7) about, (8) pass1, and (9) pass2 parameters in a register action. [Read the notes from the security team](https://ubuntu.com/security/CVE-2010-4402#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | wordpress | 10.10 maverick | Not affected | | 10.04 LTS lucid | Not affected | | 9.10 karmic | Not affected | | 8.04 LTS hardy | Not affected | | 6.06 LTS dapper | Not affected | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ## Notes --- ### [jdstrand](https://launchpad.net/~jdstrand) code not present: wp-content/plugins/register-plus/dash\_widget.php wp-content/plugins/register-plus/register-plus.php ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4402) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2010-4402) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2010-4402) * [Debian](https://security-tracker.debian.org/tracker/CVE-2010-4402) ### Other references *