CVE-2024-5324

CVE-2024-5324 登录/注册弹窗（内联表单 + Woocommerce）2.7.1 - 2.7.2 - 缺少授权导致任意选项更新 描述： WordPress 的 Login/Signup Popup Inline Form + Woocommerce 插件在 2.7.1 至 2.7.2 版本中，由于 'importsettings' 函数缺少权限检查，容易受到未经授权的数据修改。这使得经过身份验证的攻击者（具有订阅者级别及更高级别的访问权限）能够更改受影响站点上的任意选项。这可用于启用新用户注册，并将新用户的默认角色设置为管理员。 Severity: high CVE ID:...

WordPress Login & Register Forms plugin < 4.0.2 - Unauthenticated Account Takeover via Password Reset Code Brute Force vulnerability

Unauthenticated Account Takeover via Password Reset Code Brute Force vulnerability discovered by ryan fabella in WordPress Plugin Login/Signup Popup versions 4.0.2...

WordPress Login & Register Forms plugin < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response vulnerability

Unauthenticated Registered User Email Address Disclosure via Lost Password Response vulnerability discovered by Artus KG in WordPress Plugin Login/Signup Popup versions 4.0.2...

CVE-2026-14836 Login/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limit Bypass

The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both the verification code and the per-source attempt counter on an unauthenticated, client-controlled value, allowing unauthenticated attackers t...

EUVD-2024-46839

Malicious code in bioql PyPI...

EUVD-2025-28356

Malicious code in bioql PyPI...

CVE-2025-50027

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in xootix Login/Signup Popup easy-login-woocommerce allows Stored XSS.This issue affects Login/Signup Popup: from n/a through = 2.9.4...

CVE-2025-50027 WordPress Login/Signup Popup plugin <= 2.9.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in xootix Login/Signup Popup easy-login-woocommerce allows Stored XSS.This issue affects Login/Signup Popup: from n/a through = 2.9.4...

CVE-2025-50027: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in xootix Login/Signup Popup easy-login-woocommerce allows Stored XSS.This issue affects Login/Signup Popup: from n/a through = 2.9.4...

WordPress plugin Login/Signup Popup 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

PT-2025-26384 · Unknown · Xootix Login/Signup Popup

Name of the Vulnerable Software and Affected Versions: xootix Login/Signup Popup versions n/a through 2.9.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS in the xootix Login/Signup Popu...

CVE-2025-1064 Login/Signup Popup ( Inline Form + Woocommerce ) <= 2.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action Shortcode

The Login/Signup Popup Inline Form + Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xooelaction shortcode in all versions up to, and including, 2.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...

PT-2025-7488

Name of the Vulnerable Software and Affected Versions Login/Signup Popup Inline Form + Woocommerce plugin for WordPress versions up to, and including, 2.8.5 Description The issue concerns a Stored Cross-Site Scripting vulnerability via the plugin's xoo el action shortcode due to insufficient inpu...

CVE-2025-1064: Improper Neutralization of Input During Web Page Generation

The Login/Signup Popup Inline Form + Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xooelaction shortcode in all versions up to, and including, 2.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...

WordPress plugin Login/Signup Popup 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

CVE-2024-5665

The Login/Signup Popup Inline Form + Woocommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ‘exportsettings’ function in versions 2.7.1 to 2.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2024-5665

CVE-2024-5665 affects the Login/Signup Popup (Inline Form + Woocommerce) WordPress plugin. In versions 2.7.1–2.7.2, export_settings is missing a capability check, enabling authenticated users with Subscriber-level access and above to read arbitrary options on affected sites. The vulnerability is ...

WordPress Login/Signup Popup ( Inline Form + Woocommerce ) plugin <= 2.7.2 - Missing Authorization to Arbitrary Options Exposure vulnerability

Missing Authorization to Arbitrary Options Exposure vulnerability discovered by 1337Wannabe in WordPress Plugin Login/Signup Popup versions = 2.7.2...

CVE-2024-5324

The Login/Signup Popup Inline Form + Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'importsettings' function in versions 2.7.1 to 2.7.2. This makes it possible for authenticated attackers, with Subscriber-level access...

CVE-2024-5324

The Login/Signup Popup (Inline Form + Woocommerce) WordPress plugin is vulnerable to unauthorized data modification in versions 2.7.1 through 2.7.2 . The root cause is a missing capability check on the import_settings function, which allows authenticated attackers with Subscriber-level access and...