WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
login-register
Published
2026-03-20
Title
login_register <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
login-register-using-jwt
Published
2025-11-18
Title
WP Login and Register using JWT < 3.1.0 - Missing Authorization to Authenticated (Subscriber+) API Key Exposure
Slug
login-screen-manager
Published
2023-10-09
Title
Login screen manager <= 3.5.2 - Admin+ Stored XSS
Slug
login-screen-manager
Published
2023-10-31
Title
Login Screen Manager <= 3.5.2 - Stored XSS via CSRF
Slug
login-sidebar-widget
Published
2014-09-21
Title
Login Widget With Shortcode 3.1.1 - custom_style_afo Parameter Reflected XSS
Slug
login-sidebar-widget
Published
2014-09-21
Title
Login Widget With Shortcode 3.1.1 - CSRF/XSS
Slug
login-sidebar-widget
Published
2024-12-05
Title
Login Widget With Shortcode <= 6.1.2 - Open Redirect
Slug
login-social
Published
2026-07-21
Title
Huge IT Login <= 1.0.4 - Unauthenticated Account Takeover
Slug
login-watchdog
Published
2025-01-16
Title
Login Watchdog <= 1.0.4 - Reflected Cross-Site Scripting
Slug
login-widget-for-ultimate-member
Published
2025-03-27
Title
Login Widget for Ultimate Member < 1.1.3 - Authenticated (Contributor+) Local File Inclusion
Slug
login-with-ajax
Published
2012-05-18
Title
Login With Ajax - Cross-Site Scripting (XSS)
Slug
login-with-ajax
Published
2014-08-01
Title
Login With Ajax - Cross-Site Request Forgery
Slug
login-with-ajax
Published
2017-04-11
Title
Login with AJAX Plugin <= 3.1.6 - Cross-Site Scripting (XSS)
Slug
login-with-ajax
Published
2023-12-07
Title
Login With Ajax < 4.2 - Missing Authorization
Slug
login-with-ajax
Published
2024-04-10
Title
Login With Ajax < 4.2 - Cross-Site Request Forgery to Notice Dismissal
Slug
login-with-ajax
Published
2026-08-18
Title
Login With Ajax – Fast Logins, 2FA, Redirects <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
login-with-ajax
Published
2026-09-01
Title
Login With Ajax – Fast Logins, 2FA, Redirects <= 4.5.1 - Authenticated (Customer+) Stored Cross-Site Scripting
Slug
login-with-azure
Published
2021-08-30
Title
Multiple Plugins from miniorange - Reflected Cross-Site Scripting via appId
Slug
login-with-azure
Published
2026-03-02
Title
All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login < 2.2.6 - Authentication Bypass
Slug
login-with-cognito
Published
2021-08-30
Title
Multiple Plugins from miniorange - Reflected Cross-Site Scripting via appId
Slug
login-with-cognito
Published
2022-12-07
Title
Login with Cognito < 1.4.9 - Admin+ Stored XSS
Slug
login-with-google
Published
2026-08-13
Title
Log in with Google < 1.4.3 - Authentication Bypass
Slug
login-with-phone-number
Published
2022-02-16
Title
Login with phone number < 1.3.7 - Unauthenticated remote plugin deletion
Slug
login-with-phone-number
Published
2022-07-05
Title
Login with phone number < 1.3.8 - Multiple Admin+ Stored XSS
Slug
login-with-phone-number
Published
2023-01-12
Title
Login with Phone Number < 1.4.2 - Reflected Cross-Site Scripting