CVE-2022-0347

CVE-2022-0347 affects the LoginPress | Custom Login Page Customizer WordPress plugin prior to 1.5.12. The root cause is that the redirect-page parameter is not escaped before being output in an attribute, enabling a Reflected Cross-Site Scripting attack. This can allow an attacker to inject JavaS...

CVE-2019-15872

CVE-2019-15872 affects the WordPress LoginPress plugin prior to version 1.1.4, with a SQL injection via an import of settings. The NVD entry rates CVSSv3 as 9.8 (CRITICAL) and CVSSv2 as 7.5 (HIGH). Multiple sources corroborate: vulnerability in LoginPress

CVE-2019-15871

CVE-2019-15871 affects the WordPress LoginPress plugin prior to version 1.1.4. The root cause is a missing capability check for updates to settings, enabling unauthorized actions related to configuration changes. Public references confirm the issue in/LoginPress plugin and echo the need for a ven...

CVE-2022-41839

CVE-2022-41839 affects the WordPress LoginPress plugin (versions ≤ 1.6.2). The issue is a Broken Access Control that allows unauthorized changes to Opt-In/Opt-Out tracking settings. The published sources consistently describe unauthenticated modification of tracking preferences as the impact. Rem...