| Reporter | Title | Published | Views | Family All 13 |
|---|---|---|---|---|
 | CVE-2025-14975 | 29 Jan 202606:00 | – | attackerkb |
 | CVE-2025-14975 | 29 Jan 202609:17 | – | circl |
 | WordPress plugin Custom Login Page Customizer has a security vulnerability | 29 Jan 202600:00 | – | cnnvd |
 | CVE-2025-14975 Custom Login Page Customizer < 2.5.4 - Unauthenticated Arbitrary Password Reset | 29 Jan 202606:00 | – | cvelist |
 | EUVD-2025-206542 | 29 Jan 202606:00 | – | euvd |
 | CVE-2025-14975 | 29 Jan 202606:15 | – | nvd |
 | 📄 WordPress Login Customizer 2.5.3 Unauthenticated Account Takeover | 21 Jul 202600:00 | – | packetstorm |
 | WordPress Custom Login Page Customizer plugin < 2.5.4 - Unauthenticated Arbitrary Password Reset vulnerability | 30 Jan 202609:35 | – | patchstack |
 | PT-2026-5248 | 29 Jan 202600:00 | – | ptsecurity |
 | CVE-2025-14975 | 30 Jan 202610:10 | – | redhatcve |
10
Node
custom_login_page_customizerRange2.1.1–2.5.4wordpress
[
{
"vendor": "Unknown",
"product": "Custom Login Page Customizer",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "2.1.1",
"lessThan": "2.5.4"
}
],
"defaultStatus": "unaffected"
}
]| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| user_login | query param | wp-login.php?action=lostpassword | Initiates password reset and poisons the reset key by submitting attacker-controlled values. | CWE-269 |
| user_pass | query param | wp-login.php?action=lostpassword | Initiates password reset and poisons the reset key by submitting attacker-controlled values. | CWE-269 |
| wp-submit | query param | wp-login.php?action=lostpassword | Initiates password reset and poisons the reset key by submitting attacker-controlled values. | CWE-269 |
| redirect_to | query param | wp-login.php?action=lostpassword | Initiates password reset and poisons the reset key by submitting attacker-controlled values. | CWE-269 |
| key | query param | wp-login.php?action=rp | Uses the poisoned reset key to set up a known reset token for the target user. | CWE-269 |
| login | query param | wp-login.php?action=rp | Uses the poisoned reset key to set up a known reset token for the target user. | CWE-269 |
| pass1 | request body | wp-login.php?action=resetpass | Completes the reset process using the attacker-provided key to set a new administrator password. | CWE-269 |
| pass2 | request body | wp-login.php?action=resetpass | Completes the reset process using the attacker-provided key to set a new administrator password. | CWE-269 |
| rp_key | request body | wp-login.php?action=resetpass | Completes the reset process using the attacker-provided key to set a new administrator password. | CWE-269 |
| user_pass | request body | wp-login.php?action=resetpass | Completes the reset process using the attacker-provided key to set a new administrator password. | CWE-269 |
10
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Jun 2026 08:36Current
5.9Medium risk
Vulners AI Score5.9
CVSS 3.18.1
EPSS0.00306
SSVC