WordPress Register Plus Plugin <= 3.5.1 - Multiple XSS

Because of these vulnerabilities in wp-login.php, the attackers can inject arbitrary web script or HTML via the “website”, “aim”, “yahoo”, “jabber”, “firstname”, “lastname”, “about”, “pass1”, and “pass2” parameters in a register action.

Solution

           Update the plugin.