| Reporter | Title | Published | Views | Family All 13 |
|---|---|---|---|---|
 | CVE-2025-14975 | 29 Jan 202606:00 | – | attackerkb |
 | CVE-2025-14975 | 29 Jan 202609:17 | – | circl |
 | WordPress plugin Custom Login Page Customizer has a security vulnerability | 29 Jan 202600:00 | – | cnnvd |
 | CVE-2025-14975 Custom Login Page Customizer < 2.5.4 - Unauthenticated Arbitrary Password Reset | 29 Jan 202606:00 | – | cvelist |
 | EUVD-2025-206542 | 29 Jan 202606:00 | – | euvd |
 | CVE-2025-14975 | 29 Jan 202606:15 | – | nvd |
 | 📄 WordPress Login Customizer 2.5.3 Unauthenticated Account Takeover | 21 Jul 202600:00 | – | packetstorm |
 | WordPress Custom Login Page Customizer plugin < 2.5.4 - Unauthenticated Arbitrary Password Reset vulnerability | 30 Jan 202609:35 | – | patchstack |
 | PT-2026-5248 | 29 Jan 202600:00 | – | ptsecurity |
 | CVE-2025-14975 | 30 Jan 202610:10 | – | redhatcve |
10
Node
[
{
"vendor": "Unknown",
"product": "Custom Login Page Customizer",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "2.1.1",
"lessThan": "2.5.4"
}
],
"defaultStatus": "unaffected"
}
]| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| user_login | request body | wp-login.php?action=lostpassword | Unauthenticated password reset flow via lostpassword endpoint enabling manipulation of reset key | CWE-269 |
| user_pass | request body | wp-login.php?action=lostpassword | Unauthenticated password reset flow via lostpassword endpoint enabling manipulation of reset key | CWE-269 |
| key | query param | wp-login.php?action=rp&key={key}&login={admin} | Password reset flow using attacker-supplied reset key to gain access | CWE-269 |
| login | query param | wp-login.php?action=rp&key={key}&login={admin} | Password reset flow using attacker-supplied reset key to gain access | CWE-269 |
| pass1 | request body | wp-login.php?action=resetpass | Submit new password using known reset key to set administrator password | CWE-269 |
| pass2 | request body | wp-login.php?action=resetpass | Submit new password using known reset key to set administrator password | CWE-269 |
| rp_key | request body | wp-login.php?action=resetpass | Submit new password using known reset key to set administrator password | CWE-269 |
| user_pass | request body | wp-login.php?action=resetpass | Submit new password using known reset key to set administrator password | CWE-269 |
| log | request body | wp-login.php | Final login attempt using attacker-chosen credentials to take over the administrator account | CWE-269 |
| pwd | request body | wp-login.php | Final login attempt using attacker-chosen credentials to take over the administrator account | CWE-269 |
10
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Jun 2026 08:36Current
5.9Medium risk
Vulners AI Score5.9
CVSS 3.18.1
EPSS0.00312
SSVC