CVE-2024-6289

The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the authredirect WordPress function, allowing an unauthenticated visitor to access the hidden login page...

CVE-2024-8715

The Simple LDAP Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVE-2024-8665

The YITH Custom Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVE-2023-34025

Cross-Site Request Forgery CSRF vulnerability in LWS LWS Hide Login plugin = 2.1.6 versions...

CVE-2023-27425

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in James Irving-Swift Electric Studio Client Login plugin = 0.8.1 versions...

CVE-2023-46201

Cross-Site Request Forgery CSRF vulnerability in Jeff Sherk Auto Login New User After Registration allows Stored XSS.This issue affects Auto Login New User After Registration: from n/a through 1.9.6...

CVE-2023-41936

Jenkins Google Login Plugin 1.7 and earlier uses a non-constant time comparison function when checking whether the provided and expected token are equal, potentially allowing attackers to use statistical methods to obtain a valid token...

CVE-2023-27461

Cross-Site Request Forgery CSRF vulnerability in Yoohoo Plugins When Last Login plugin = 1.2.1 versions...

CVE-2023-33313

Cross-Site Request Forgery CSRF vulnerability in ThemeinProgress WIP Custom Login plugin = 1.2.9 versions...

CVE-2022-46683

Jenkins Google Login Plugin 1.4 through 1.6 both inclusive improperly determines that a redirect URL after login is legitimately pointing to Jenkins...

CVE-2015-5298

The Google Login Plugin versions 1.0 and 1.1 allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps domain through client-side request modification...

CVE-2015-9336

The clean-login plugin before 1.5.1 for WordPress has reflected XSS...

CVE-2019-15825

The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp protection bypass...

CVE-2019-15826

The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field...

Exploit for CVE-2025-3605

🚀 CVE-2025-3605 Exploit Guide 🛡️ Vulnerability Summary Th...

CVE-2025-1506

CVE-2025-1506 documents confirm a Cross-Site Forgery (CSRF) vulnerability in the WordPress plugin “Wp Social Login and Register Social Counter” up to version 3.1.0. The root cause is missing or incorrect nonce validation on the counter_access_key_setup() function, enabling unauthenticated attacke...

WordPress UMich OIDC Login plugin <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by yudha in WordPress Plugin UMich OIDC Login versions = 1.2.0...

WordPress My Login Logout Plugin plugin <= 2.4 - CSRF to Stored Cross-Site Scripting vulnerability

CSRF to Stored Cross-Site Scripting vulnerability discovered by Abdi Pranata in WordPress Plugin My Login Logout Plugin versions = 2.4...

CVE-2024-5150

The Login with phone number plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.26. This is due to the 'activationcode' default value is empty, and the not empty check is missing in the 'lwpajaxregister' function. This makes it possible for...

CVE-2024-8252

The Clean Login plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.14.5 via the 'template' attribute of the clean-login-register shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and...