Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · wps-hide-login
WPS Hide Login
10 known vulnerabilities on record. Add your version above to see which ones affect you.
Jul 15, 2024WPS Hide Login: Does not prevent redirects to the login page via the auth_redirect WordPress functionCVE-2024-6289 · fixed in 1.9.16.4 · reported by WPScanMedium 6.1
The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.
Jun 10, 2024WPS Hide Login: Login Page DisclosureCVE-2024-2473 · affects up to 1.9.15.2 · reported by WordfenceMedium 5.3
The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the 'action=postpass' parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin.
Jun 4, 2024WPS Hide Login: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-49748 · affects up to 1.9.11 · reported by PatchstackLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPServeur, NicolasKulka, wpformation WPS Hide Login allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPS Hide Login: from n/a through 1.9.11.
Jun 6, 2023WPS Hide Login: Login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sitesCVE-2020-36710 · affects up to 1.5.4.2 · reported by WordfenceMedium 5.3
The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sites in versions up to, and including, 1.5.4.2.
Dec 6, 2021WPS Hide Login: Has a bugCVE-2021-24917 · fixed in 1.9.1 · reported by WPScanHigh 7.5
The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user.
Oct 22, 2019The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value.CVE-2015-9498 · fixed in 1.1 · reported by MITREHigh 8.8
The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value.
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.CVE-2019-15826 · fixed in 1.5.3 · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.CVE-2019-15825 · fixed in 1.5.3 · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.CVE-2019-15824 · fixed in 1.5.3 · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.
Aug 30, 2019The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.CVE-2019-15823 · fixed in 1.5.3 · reported by MITRECritical 9.8
The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.