CVE-2023-0552

The Registration Forms WordPress plugin before 3.8.2.3 does not properly validate the redirection URL when logging in and login out, leading to an Open Redirect vulnerability...

CVE-2025-48061 wire-webapp Has Insufficient Session Invalidation after User Logout

wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidated. A user that logged out of the Wire webapp, could have been automatically logged in again after re-opening the application. This does no...

CVE-2025-26547

Cross-Site Request Forgery CSRF vulnerability in nagarjunsonti My Login Logout Plugin my-loginlogout allows Stored XSS.This issue affects My Login Logout Plugin: from n/a through = 2.4...

CVE-2025-26547

Cross-Site Request Forgery CSRF vulnerability in nagarjunsonti My Login Logout Plugin my-loginlogout allows Stored XSS.This issue affects My Login Logout Plugin: from n/a through = 2.4...

CVE-2025-26547 WordPress My Login Logout Plugin plugin <= 2.4 - CSRF to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery CSRF vulnerability in nagarjunsonti My Login Logout Plugin allows Stored XSS. This issue affects My Login Logout Plugin: from n/a through 2.4...

CVE-2025-26547

CVE-2025-26547 describes a CSRF-based vulnerability in the WordPress plugin My Login Logout Plugin (versions n/a through 2.4) that enables Stored XSS. Underlying issue is CSRF allowing injected scripts to be stored and later executed by other users. Reported base CVSS v3.1 score is 7.1 (High) wit...

CVE-2025-26547 WordPress My Login Logout Plugin plugin <= 2.4 - CSRF to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery CSRF vulnerability in nagarjunsonti My Login Logout Plugin my-loginlogout allows Stored XSS.This issue affects My Login Logout Plugin: from n/a through = 2.4...

WordPress plugin My Login Logout Plugin 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2025-7183 · WordPress · My Login Logout Plugin

Name of the Vulnerable Software and Affected Versions: My Login Logout Plugin versions n/a through 2.4 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

CVE-2025-26547: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in nagarjunsonti My Login Logout Plugin my-loginlogout allows Stored XSS.This issue affects My Login Logout Plugin: from n/a through = 2.4...

CVE-2024-9421

The Login Logout Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2024-9421 Login Logout Shortcode <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter

The Login Logout Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

WordPress Login Logout Shortcode plugin <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via class Parameter vulnerability discovered by theviper17y in WordPress Plugin Login Logout Shortcode versions = 1.1.0...

WordPress Login Logout Shortcode Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Login Logout Shortcode Type Plugin Vulnerable versions = 1.1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9421 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ffc1bb236d2a Credits theviper17y Require...

CVE-2024-9421: Improper Neutralization of Input During Web Page Generation

The Login Logout Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

PT-2024-27424 · WordPress · Login Logout Register Menu

Name of the Vulnerable Software and Affected Versions: Login Logout Register Menu plugin for WordPress versions up to, and including, 2.0 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'llrmloginlogout' shortcode...

CVE-2024-3726: Improper Neutralization of Input During Web Page Generation

The Login Logout Register Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'llrmloginlogout' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2024-25977 Session Fixation

The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser e.g. via XSS and prompt the victim to log in e.g. via a redirect to the login page. This results in the victim's account being taken over...

PT-2024-21251 · Interaction Design Team At The University Of Applied Sciences Arts In Hildesheim/Germany +1 · Hawki

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser, for example via XSS, and...

HAWKI 跨站脚本漏洞

HAWKI is a university teaching interface based on the OpenAI API by the HAWK Digital Environments team in Germany. HAWKI suffers from a cross-site scripting vulnerability that stems from the application not changing the session token when using the login or logout function, leading to a takeover ...