Plugin icon

Theme My Login

theme-my-login

Vulnerabilities:

8

Last Updated:

October 13, 2026

Active Installs:

50000

Published
Title
Fixed in
CVSS
Published
2026-10-15
Title
Theme My Login < 7.2.2 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter
Fixed in
Fixed in 7.2.2
CVSS
9.8 (critical)
Published
2026-09-04
Title
Theme My Login < 7.2.0 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage
Fixed in
Fixed in 7.2.0
CVSS
4.3 (medium)
Published
2026-08-31
Title
Theme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation
Fixed in
Fixed in 7.2.0
CVSS
5.4 (medium)
Published
2026-08-06
Title
Theme My Login < 7.1.15 - Cross-Site Request Forgery
Fixed in
Fixed in 7.1.15
CVSS
4.3 (medium)
Published
2025-09-26
Title
Theme My Login < 7.1.13 - Missing Authorization
Fixed in
Fixed in 7.1.13
CVSS
5.3 (medium)
Published
2024-08-15
Title
Theme My Login < 7.1.8 - Cross-Site Request Forgery to Settings Update
Fixed in
Fixed in 7.1.8
CVSS
4.3 (medium)
Published
2024-04-15
Title
Theme My Login < 7.1.7 - Missing Authorization to Notice Dismissal
Fixed in
Fixed in 7.1.7
CVSS
4.3 (medium)
Published
2014-08-01
Title
Theme My Login 6.3.9 - Local File Inclusion
Fixed in
Fixed in 6.3.10
CVSS
n/a