WordPress Plugin Vulnerabilities

Clean Login 1.12.6.3 - Reflected Cross-Site Scripting

Description

The plugin does not escape the url parameter in its login form page, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

Affects Plugins

Plugin icon
clean-login
Fixed in 1.12.6.4

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
6782ee79-6930-4a40-b416-d2248f78d995

Timeline

Publicly Published
2021-08-09 (about 4 years ago)
Added
2021-08-09 (about 4 years ago)
Last Updated
2021-08-09 (about 4 years ago)

Other

Published
Title
Published
2024-03-05
Title
Simple Membership < 4.4.3 - Unauthenticated Stored Self-Based Cross-Site Scripting
Published
2020-09-09
Title
Elementor Addon Elements < 1.6.4 - CSRF & XSS
Published
2023-04-03
Title
Albo Pretorio Online < 4.6.2 - Reflected XSS
Published
2020-08-26
Title
FooGallery < 1.9.25 - Authenticated Cross-Site Scripting (XSS)
Published
2025-06-05
Title
Post Custom Templates Lite <= 1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting