All In One Login
Monthly
Reflected cross-site scripting in the All In One Login WordPress plugin through version 2.4.1 allows an unauthenticated remote attacker to run arbitrary script in a victim's browser within the context of the affected WordPress site, after convincing that victim to follow a crafted link or load an attacker-supplied page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, scope changed). Impact is limited to confidentiality and integrity of data reachable from the victim's session, with no availability effect assessed; the exact vulnerable parameter and endpoint are not described in the available sources. No public exploit code has been identified at time of analysis, and priority is assessed as 'this_week' - mixed signals leaning toward moderate rather than critical, mainly because successful exploitation depends on victim interaction and on the site running the plugin at an affected version.
The Change WP Admin Login WordPress plugin before 1.1.4 discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offered. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Reflected cross-site scripting in the All In One Login WordPress plugin through version 2.4.1 allows an unauthenticated remote attacker to run arbitrary script in a victim's browser within the context of the affected WordPress site, after convincing that victim to follow a crafted link or load an attacker-supplied page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, scope changed). Impact is limited to confidentiality and integrity of data reachable from the victim's session, with no availability effect assessed; the exact vulnerable parameter and endpoint are not described in the available sources. No public exploit code has been identified at time of analysis, and priority is assessed as 'this_week' - mixed signals leaning toward moderate rather than critical, mainly because successful exploitation depends on victim interaction and on the site running the plugin at an affected version.
The Change WP Admin Login WordPress plugin before 1.1.4 discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offered. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.