Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · clean-login
clean-login
8 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 28, 2026Clean Login: Missing AuthorizationCVE-2026-116610 · affects up to 1.20.1 · reported by WordfenceMedium 4.3
The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the CleanLogin_Shortcode::get_pages_with_shortcodes() function hooked to the save_post action. This makes it possible for authenticated attackers, with Contributor-level access and above, to overwrite the plugin's cl_login_url/cl_login_id/cl_register_url/cl_register_id/cl_restore_url/cl_restore_id/cl_edit_url/cl_edit_id/cl_change_password_url/cl_change_password_id options with the ID and permalink of a post they themselves authored — simply by embedding the plugin's shortcodes in their own post content.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 18, 2026Clean Login: Does not verify its registration CAPTCHACVE-2026-90977 · fixed in 1.19 · reported by WPScanMedium 5.3
The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it.
Sep 18, 2026Clean Login: Does not check whether user registration is enabled before creating an account in its registration handlerCVE-2026-90976 · fixed in 1.19 · reported by WPScanMedium 5.3
The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled.
Jun 17, 2026Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.CVE-2026-54184 · affects up to 1.15 · reported by PatchstackHigh 8.2
Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.
Aug 30, 2024Clean Login: Local File InclusionCVE-2024-8252 · affects up to 1.14.5 · reported by WordfenceHigh 8.8
The Clean Login plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.14.5 via the 'template' attribute of the clean-login-register shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 6, 2023Clean Login: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4838 · fixed in 1.13.7 · reported by WPScanMedium 5.4
The Clean Login WordPress plugin before 1.13.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Aug 22, 2019The clean-login plugin before 1.5.1 for WordPress has reflected XSS.CVE-2015-9336 · fixed in 1.5.1 · reported by MITREMedium 6.1
The clean-login plugin before 1.5.1 for WordPress has reflected XSS.
May 10, 2017CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL.CVE-2017-8875 · fixed in 1.8 · reported by MITREMedium 6.5
CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.