Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,616 results · page 16 of 73
Jul 1, 2025An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint.CVE-2025-34062 · Other software · One Identity · reported by VulnCheckMedium 5.7
An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint. An attacker with access to a valid directory_token—which may be retrievable from host registry keys or improperly secured logs—can retrieve a plaintext response disclosing sensitive credentials. These may include an API key, AWS IAM access and secret keys, and a base64-encoded JWT signing key used in the tenant’s SSO IdP configuration.
- Product
- OneLogin Active Directory Connector (ADC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordspecterops.iosupport.onelogin.com
Jul 1, 2025Custom Login And Signup Widget: Improper Control of Generation of Code ('Code Injection')CVE-2025-49029 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.kazi Custom Login And Signup Widget custom-login-and-signup-widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through <= 1.0.
- Product
- Custom Login And Signup Widget
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Custom Login And Signup Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 1, 2025An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available setCVE-2025-41648 · Other software · Pilz · reported by info@cert.vde.comCritical 9.8
An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the IndustrialPI.
- Product
- IndustrialPI 4 with IndustrialPI webstatus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a craCVE-2023-44915 · Other software · reported by MITREHigh 7.1
A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login_error parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2025In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting (XSS), which allows a privileged, authenticated attacker to exfiltrate user inpuCVE-2024-56918 · Other software · Netbox · reported by MITREMedium 6.1
In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting (XSS), which allows a privileged, authenticated attacker to exfiltrate user input from the login form.
- Product
- Netbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2025An low privileged remote attacker in possession of the second factor for another user can login as that user without knowledge of the other user`s password.CVE-2025-3091 · Other software · MB connect line · reported by info@cert.vde.comHigh 7.5
An low privileged remote attacker in possession of the second factor for another user can login as that user without knowledge of the other user`s password.
- Product
- mbCONNECT24
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Jun 20, 2025Login/Signup Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50027 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xootix Login/Signup Popup easy-login-woocommerce allows Stored XSS.This issue affects Login/Signup Popup: from n/a through <= 2.9.4.
- Product
- Login/Signup Popup
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update Login/Signup Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025IP Based Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50016 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brijeshk89 IP Based Login ip-based-login allows Stored XSS.This issue affects IP Based Login: from n/a through <= 2.4.2.
- Product
- IP Based Login
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update IP Based Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 18, 2025CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component.CVE-2025-26198 · Other software · Vishalmathur · reported by MITRECritical 9.8
CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-supplied input in the admin login form before directly including it in SQL queries. This allows unauthenticated attackers to inject arbitrary SQL payloads and bypass authentication, gaining unauthorized administrative access. The vulnerability is triggered when an attacker supplies specially crafted input in the username field, such as ' OR '1'='1, leading to complete compromise of the login mechanism and potential exposure of sensitive backend data.
- Product
- Cloudclassroom-php Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jun 12, 2025WP Sliding Login/Dashboard Panel: Cross-Site Request ForgeryCVE-2025-5928 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the wp_sliding_panel_user_options() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Sliding Login/Dashboard Panel
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update WP Sliding Login/Dashboard Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 12, 2025The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the CVE-2025-49195 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the FTP server.
- Product
- SICK Media Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existingCVE-2025-49187 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one.
- Product
- SICK Field Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get full access to the apCVE-2025-49182 · Other software · SICK AG · reported by psirt@sick.deHigh 7.5
Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get full access to the application.
- Product
- SICK Media Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API.CVE-2025-27819 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0
- Product
- Apache Kafka
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025One-Login: Incorrect Privilege AssignmentCVE-2025-23974 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Incorrect Privilege Assignment vulnerability in ifkooo One-Login one-login allows Privilege Escalation.This issue affects One-Login: from n/a through <= 1.4.
- Product
- One-Login
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update One-Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Read More Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28989 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arildur Read More Login read-more-login allows Stored XSS.This issue affects Read More Login: from n/a through <= 2.0.3.
- Product
- Read More Login
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Read More Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 31, 2025PSW Front-end Login & Registration: Privilege EscalationCVE-2025-4607 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The PSW Front-end Login & Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12 via the customer_registration() function. This is due to the use of a weak, low-entropy OTP mechanism in the forget() function. This makes it possible for unauthenticated attackers to initiate a password reset for any user, including administrators, and elevate their privileges for full site takeover.
- Product
- PSW Front-end Login & Registration
- Affected
- up to 1.12
- What to do
- Affects up to 1.12. Update PSW Front-end Login & Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 23, 2025WordPress Social Login and Register: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47670 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social Login and Register: from n/a through <= 7.6.10.
- Product
- WordPress Social Login and Register
- Affected
- up to 7.6.10
- What to do
- Affects up to 7.6.10. Update WordPress Social Login and Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025PSW Front-end Login & Registration: Weak Password Recovery Mechanism for Forgotten PasswordCVE-2025-47646 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Gilblas Ngunte Possi PSW Front-end Login & Registration psw-login-and-registration allows Password Recovery Exploitation.This issue affects PSW Front-end Login & Registration: from n/a through <= 1.13.
- Product
- PSW Front-end Login & Registration
- Affected
- up to 1.13
- What to do
- Affects up to 1.13. Update PSW Front-end Login & Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 22, 2025A reflected cross-site scripting (XSS) vulnerability exists in the sub-organization login flow of WSO2 Identity Server 7.0.0 due to improper input validation.CVE-2024-7103 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Medium 4.6
A reflected cross-site scripting (XSS) vulnerability exists in the sub-organization login flow of WSO2 Identity Server 7.0.0 due to improper input validation. A malicious actor can exploit this vulnerability to inject arbitrary JavaScript into the login flow, potentially leading to UI modifications, redirections to malicious websites, or data exfiltration from the browser. While this issue could allow an attacker to manipulate the user’s browser, session-related sensitive cookies remain protected with the httpOnly flag, preventing session hijacking.
- Product
- WSO2 Identity Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
May 21, 2025An issue in D-Link DI-8100 16.07.26A1 allows a remote attacker to bypass administrator login authenticationCVE-2025-44083 · Other software · Dlink · reported by MITRECritical 9.8
An issue in D-Link DI-8100 16.07.26A1 allows a remote attacker to bypass administrator login authentication
- Product
- Di-8100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025DIGITS: WordPress Mobile Number Signup and Login: Does not rate limit OTP validation attemptsCVE-2025-4094 · WordPress plugins & themes · reported by WPScanCritical 9.8
The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.
- Product
- DIGITS: WordPress Mobile Number Signup and Login
- Fixed in
- 8.4.6.1
- What to do
- Update DIGITS: WordPress Mobile Number Signup and Login to 8.4.6.1 or newer.
May 20, 2025FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the theauthName parameter in the web_aaa_loginAuthlistEdit function.CVE-2025-44898 · Other software · Planet · reported by MITRECritical 9.8
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the theauthName parameter in the web_aaa_loginAuthlistEdit function.
- Product
- Wgs-804hpt Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025Failed login response could be different depending on whether the username was local or central.CVE-2025-48015 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comLow 3.7
Failed login response could be different depending on whether the username was local or central.
- Product
- SEL-5056 Software-Defined Network Flow Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025IP Based Login: Does not sanitise valuesCVE-2024-12800 · WordPress plugins & themes · reported by WPScanMedium 4.8
The IP Based Login WordPress plugin before 2.4.1 does not sanitise values when importing, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- IP Based Login
- Fixed in
- 2.4.1
- What to do
- Update IP Based Login to 2.4.1 or newer.
May 15, 2025LogDash Activity Log: Hooks the wp_login_failed function (from src/Hooks/UsersCVE-2023-6030 · WordPress plugins & themes · reported by WPScanMedium 5.4
The LogDash Activity Log WordPress plugin before 1.1.4 hooks the wp_login_failed function (from src/Hooks/Users.php) in order to log failed login attempts to the database but it doesn't escape the username when it perform some SQL request leading to a SQL injection vulnerability which can be exploited using time-based technique by unauthenticated attacker
- Product
- LogDash Activity Log
- Fixed in
- 1.1.4
- What to do
- Update LogDash Activity Log to 1.1.4 or newer.
May 15, 2025Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which CVE-2025-31947 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 5.8
Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025The HttpAuth plugin in pGina.Fork through 3.9.9.12 allows authentication bypass when an adversary controls DNS resolution for pginaloginserver.CVE-2025-48027 · Other software · MutonUfoAI · reported by MITREMedium 5.4
The HttpAuth plugin in pGina.Fork through 3.9.9.12 allows authentication bypass when an adversary controls DNS resolution for pginaloginserver.
- Product
- pGina.Fork
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability classified as critical has been found in Shanghai Bairui Information Technology SunloginClient 15.8.3.19819.CVE-2025-4532 · Other software · Shanghai Bairui Information Technology · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Shanghai Bairui Information Technology SunloginClient 15.8.3.19819. This affects an unknown part in the library process.dll of the file sunlogin_guard.exe. The manipulation leads to uncontrolled search path. Local access is required to approach this attack. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SunloginClient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025Frontend Login and Registration Blocks: Privilege escalationCVE-2025-3605 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.1. This is due to the plugin not properly validating a user's identity prior to updating their details like email via the flr_blocks_user_settings_handle_ajax_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
- Product
- Frontend Login and Registration Blocks
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Frontend Login and Registration Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 7, 2025On an F5OS system, if the root user had previously configured the system to allow login via SSH key-based authentication, and then enabled Appliance Mode; accesCVE-2025-36546 · Network & remote access · F5 · reported by f5sirt@f5.comCritical 9.2
On an F5OS system, if the root user had previously configured the system to allow login via SSH key-based authentication, and then enabled Appliance Mode; access via SSH key-based authentication is still allowed. For an attacker to exploit this vulnerability they must obtain the root user's SSH private key. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- F5OS - Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2025User Login History: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47676 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Faiyaz Alam User Login History user-login-history allows Stored XSS.This issue affects User Login History: from n/a through <= 2.1.6.
- Product
- User Login History
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update User Login History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Email Notification on Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47622 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados Email Notification on Login email-notification-on-login allows Stored XSS.This issue affects Email Notification on Login: from n/a through <= 1.7.0.
- Product
- Email Notification on Login
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Email Notification on Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Terms Popup On User Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47592 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Árpád Lehel Mátyus Terms Popup On User Login terms-popup-on-user-login allows Stored XSS.This issue affects Terms Popup On User Login: from n/a through <= 2.0.8.
- Product
- Terms Popup On User Login
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update Terms Popup On User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Login Lockdown & Protection: Unauthorized nonce accessCVE-2025-3766 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Login Lockdown & Protection plugin for WordPress is vulnerable to unauthorized nonce access due to a missing capability check on the ajax_run_tool function in all versions up to, and including, 2.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain a valid nonce that can be used to generate a global unlock key, which can in turn be used to add arbitrary IP address to the plugin allowlist. This can only by exploited on new installations where the site administrator hasn't visited the loginlockdown page yet.
- Product
- Login Lockdown & Protection
- Affected
- up to 2.11
- What to do
- Affects up to 2.11. Update Login Lockdown & Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 6, 2025User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Insecure Direct Object ReferenceCVE-2025-3281 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.1 via the create_stripe_subscription() function, due to missing validation on the 'member_id' user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary user accounts that have registered through the plugin.
- Product
- User Registration & Membership – Custom Registration Form, Login Form, and User Profile
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update User Registration & Membership – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 5, 2025Custom Login and Registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39363 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AlphaEfficiencyTeam Custom Login and Registration allows Stored XSS.This issue affects Custom Login and Registration: from n/a through 1.0.0.
- Product
- Custom Login and Registration
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Custom Login and Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 30, 2025A vulnerability in the login functionality of the web application of ctrlX OS allows a remote unauthenticated attacker to guess valid usernames via multiple craCVE-2025-24342 · Other software · Bosch Rexroth AG · reported by psirt@bosch.comMedium 5.3
A vulnerability in the login functionality of the web application of ctrlX OS allows a remote unauthenticated attacker to guess valid usernames via multiple crafted HTTP requests.
- Product
- ctrlX OS - Device Admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2025Custom Login and Registration: Missing AuthorizationCVE-2025-46535 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in AlphaEfficiencyTeam Custom Login and Registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Login and Registration: from n/a through 1.0.0.
- Product
- Custom Login and Registration
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Custom Login and Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025WS Force Login Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46521 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Silver Muru WS Force Login Page ws-force-login-page allows Stored XSS.This issue affects WS Force Login Page: from n/a through <= 3.0.3.
- Product
- WS Force Login Page
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update WS Force Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025WP Customize Login Page: Missing AuthorizationCVE-2025-46485 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-page allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Customize Login Page: from n/a through <= 1.6.5.
- Product
- WP Customize Login Page
- Affected
- up to 1.6.5
- What to do
- Affects up to 1.6.5. Update WP Customize Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025WP Customize Login Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46477 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-page allows Stored XSS.This issue affects WP Customize Login Page: from n/a through <= 1.6.5.
- Product
- WP Customize Login Page
- Affected
- up to 1.6.5
- What to do
- Affects up to 1.6.5. Update WP Customize Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025BruteGuard – Brute Force Login Protection: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39408 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress BruteGuard – Brute Force Login Protection bruteguard allows Reflected XSS.This issue affects BruteGuard – Brute Force Login Protection: from n/a through <= 0.1.4.
- Product
- BruteGuard – Brute Force Login Protection
- Affected
- up to 0.1.4
- What to do
- Affects up to 0.1.4. Update BruteGuard – Brute Force Login Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Frontend Login and Registration Blocks: Privilege escalationCVE-2025-3607 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.8. This is due to the plugin not properly validating a user's identity prior to updating a password. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
- Product
- Frontend Login and Registration Blocks
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Frontend Login and Registration Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 22, 2025An issue in Student Study Center Desk Management System v1.0 allows attackers to bypass authentication via a crafted GET request to /php-sscdms/admin/login.php.CVE-2023-44752 · Other software · Oretnom23 · reported by MITRECritical 9.8
An issue in Student Study Center Desk Management System v1.0 allows attackers to bypass authentication via a crafted GET request to /php-sscdms/admin/login.php.
- Product
- Student Study Center Desk Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordflashy-lemonade-192.notion.siteflashy-lemonade-192.notion.site
Apr 21, 2025Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirect_uri containing userinfo in the authority component, which CVE-2025-43916 · Other software · Sonos · reported by MITRELow 3.4
Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirect_uri containing userinfo in the authority component, which is not consistent with RFC 6819 section 5.2.3.5. An authorization code may be sent to an attacker-controlled destination. This might have further implications in conjunction with "Decompiling the app revealed a hardcoded secret."
- Product
- api.sonos.com
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Cross-Site Request ForgeryCVE-2025-3284 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.3. This is due to missing or incorrect nonce validation on the user_registration_pro_delete_account() function. This makes it possible for unauthenticated attackers to force delete users, including administrators, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- User Registration & Membership – Custom Registration Form, Login Form, and User Profile
- Affected
- up to 5.1.3
- What to do
- Affects up to 5.1.3. Update User Registration & Membership – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpuserregistration.comwordfence.com
Apr 18, 2025An issue in the login page of Seclore v3.27.5.0 allows attackers to bypass authentication via a brute force attack.CVE-2024-53591 · Other software · Seclore · reported by MITRECritical 9.8
An issue in the login page of Seclore v3.27.5.0 allows attackers to bypass authentication via a brute force attack.
- Product
- Seclore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025Improper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session hijacking attack.CVE-2025-28242 · Other software · reported by MITRECritical 9.8
Improper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session hijacking attack.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025Login Manager – Design Login Page, View Login Activity, Limit Login Attempts: Stored Cross-Site ScriptingCVE-2025-2613 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Login Manager – Design Login Page, View Login Activity, Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom logo and background URLs in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Login Manager – Design Login Page, View Login Activity, Limit Login Attempts
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Login Manager – Design Login Page, View Login Activity, Limit Login Attempts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.