Plugin icon

Login & Register Customizer – Forms, Popup, Profile & WooCommerce

easy-login-woocommerce

Vulnerabilities:

12

Last Updated:

September 30, 2026

Active Installs:

40000

Published
Title
Fixed in
CVSS
Published
2026-08-05
Title
Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Code Brute Force
Fixed in
Fixed in 4.0.2
CVSS
8.1 (high)
Published
2026-08-05
Title
Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response
Fixed in
Fixed in 4.0.2
CVSS
5.3 (medium)
Published
2026-08-05
Title
Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header
Fixed in
Fixed in 4.0.2
CVSS
8.1 (high)
Published
2026-07-17
Title
Login/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limit Bypass
Fixed in
Fixed in 3.2.5
CVSS
8.1 (high)
Published
2025-06-19
Title
Login/Signup Popup < 2.9.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.9.5
CVSS
4.4 (medium)
Published
2025-02-19
Title
Login/Signup Popup ( Inline Form + Woocommerce ) < 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action Shortcode
Fixed in
Fixed in 2.8.6
CVSS
6.4 (medium)
Published
2024-06-05
Title
Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Exposure
Fixed in
Fixed in 2.7.3
CVSS
4.3 (medium)
Published
2024-06-05
Title
XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update
Fixed in
Fixed in 2.7.3
CVSS
8.8 (high)
Published
2023-07-03
Title
Login/Signup Popup < 2.4 - Settings Reset via CSRF
Fixed in
Fixed in 2.4
CVSS
4.3 (medium)
Published
2022-01-13
Title
XootiX Plugins - Various Versions CSRF to Arbitrary Options Update
Fixed in
Fixed in 2.3
CVSS
8.8 (high)
Published
2021-11-17
Title
Login/Signup Popup < 2.2 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.2
CVSS
8.8 (high)
Published
2020-05-14
Title
Login/Signup Popup < 1.5 - Authenticated Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.5
CVSS
9.9 (critical)