CVE-2026-1398: Cross-Site Request Forgery (CSRF)

The Change WP URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'change-wp-url' page. This makes it possible for unauthenticated attackers to change the WP Login URL via a...

CVE-2025-23568

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in fredsted WP Login Attempt Log wp-login-attempt-log allows Reflected XSS.This issue affects WP Login Attempt Log: from n/a through = 1.3...

CVE-2025-12822: Missing Authorization

The WP Login and Register using JWT plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mojwtgeneratenewapikey' function in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with Subscriber-level...

EUVD-2024-45909

Malicious code in bioql PyPI...

EUVD-2025-3253

Malicious code in bioql PyPI...

EUVD-2024-29785

Malicious code in bioql PyPI...

EUVD-2024-52536

Malicious code in bioql PyPI...

EUVD-2022-35207

Malicious code in bioql PyPI...

EUVD-2024-52562

Malicious code in bioql PyPI...

CVE-2024-31927

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Aminur Islam WP Login and Logout Redirect allows Stored XSS.This issue affects WP Login and Logout Redirect: from n/a through 1.2...

CVE-2024-54442

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in cortesfrau Better WP Login Page better-wp-login-page allows Stored XSS.This issue affects Better WP Login Page: from n/a through = 1.1.2...

CVE-2021-24328

The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or validation on them. This could allow attackers to make logged in administrators change the plugin's settings to arbitrary values, and set XSS payloads on them a...

CVE-2025-27333

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in alvego Protected wp-login protected-wp-login allows Reflected XSS.This issue affects Protected wp-login: from n/a through = 2.1...

CVE-2025-27333

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in alvego Protected wp-login protected-wp-login allows Reflected XSS.This issue affects Protected wp-login: from n/a through = 2.1...

CVE-2025-27333

CVE-2025-27333 | The Protected wp-login WordPress plugin is affected by a Reflected XSS due to improper input neutralization in web page generation. Affected: Protected wp-login

PT-2025-17071 · Unknown · Alvego Protected Wp-Login

Name of the Vulnerable Software and Affected Versions: alvego Protected wp-login versions n/a through 2.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected XSS. This type of issue occurs...

CVE-2024-13836

The WP Login Control WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13836

The WP Login Control WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13836 WP Login Control <= 2.0.0 - Reflected XSS

The WP Login Control WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13836

The WP Login Control WordPress plugin, in versions through 2.0.0 , is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the failure to sanitise and escape a parameter before it is outputted back to the page. This vulnerability could be exploited to target high-privilege...