Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · feather-login-page
Feather Login Page
6 known vulnerabilities on record. Add your version above to see which ones affect you.
Dec 22, 2025Feather Login Page: Cross-Site Request Forgery (CSRF)CVE-2025-62107 · affects up to 1.1.7 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PluginOps Feather Login Page feather-login-page allows Cross Site Request Forgery.This issue affects Feather Login Page: from n/a through <= 1.1.7.
Apr 15, 2024Feather Login Page: Cross-Site Request Forgery (CSRF)CVE-2024-31923 · affects up to 1.1.5 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PluginOps Feather Login Page.This issue affects Feather Login Page: from n/a through 1.1.5.
Nov 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in Custom Login Page | Temporary Users | Rebrand Login | Login Captcha plugin <= 1.1.3 versions.CVE-2023-46777 · affects up to 1.1.3 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Custom Login Page | Temporary Users | Rebrand Login | Login Captcha plugin <= 1.1.3 versions.
May 30, 2023Feather Login Page: Cross-Site Request ForgeryCVE-2023-2549 · affects up to 1.1.1 · reported by WordfenceHigh 8.8
The Feather Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions starting from 1.0.7 up to, and including, 1.1.1. This is due to missing nonce validation in the 'createTempAccountLink' function. This makes it possible for unauthenticated attackers to create a new user with administrator role via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can leverage CVE-2023-2545 to get the login link or request a password reset to the new user's email address.
May 30, 2023Feather Login Page: Unauthorized loss of dataCVE-2023-2547 · affects up to 1.1.1 · reported by WordfenceMedium 5.4
The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete the temp user generated by the plugin.
May 30, 2023Feather Login Page: Unauthorized access of dataCVE-2023-2545 · affects up to 1.1.1 · reported by WordfenceHigh 8.1
The Feather Login Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getListOfUsers' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to access the login links, which can be used for privilege escalation.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.