Login With Ajax
Monthly
Reflected cross-site scripting in the Login With Ajax WordPress plugin (versions through 4.5.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL. The scope change in the CVSS vector (S:C) reflects the XSS payload executing outside the origin context, enabling session theft, credential harvesting, or DOM manipulation against authenticated WordPress users. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in the Login With Ajax WordPress plugin version 4.5.1 and earlier allows authenticated contributors to inject malicious scripts that execute in the browsers of higher-privileged users who view the affected content. The vulnerability carries a CVSS 3.1 score of 6.5 with scope change, meaning successful exploitation crosses the plugin's security boundary into the victim's browser session, enabling session token theft or unauthorized action execution. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and broad availability of the WordPress ecosystem make this a credible threat for sites with open contributor registration.
Cross-site request forgery (CSRF) vulnerability in the Login With Ajax plugin before 3.1 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in the Login With Ajax plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the callback parameter. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in login-with-ajax.php in the Login With Ajax (aka login-with-ajax) plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Reflected cross-site scripting in the Login With Ajax WordPress plugin (versions through 4.5.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL. The scope change in the CVSS vector (S:C) reflects the XSS payload executing outside the origin context, enabling session theft, credential harvesting, or DOM manipulation against authenticated WordPress users. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in the Login With Ajax WordPress plugin version 4.5.1 and earlier allows authenticated contributors to inject malicious scripts that execute in the browsers of higher-privileged users who view the affected content. The vulnerability carries a CVSS 3.1 score of 6.5 with scope change, meaning successful exploitation crosses the plugin's security boundary into the victim's browser session, enabling session token theft or unauthorized action execution. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and broad availability of the WordPress ecosystem make this a credible threat for sites with open contributor registration.
Cross-site request forgery (CSRF) vulnerability in the Login With Ajax plugin before 3.1 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in the Login With Ajax plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the callback parameter. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in login-with-ajax.php in the Login With Ajax (aka login-with-ajax) plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.