MediumCVSS 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Custom Login Page | Temporary Users | Rebrand Login | Login Captcha plugin <= 1.1.3 versions.
Vendor
featherplugins vulnerabilities
4 published CVES affecting featherplugins, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 4
- Critical
- 0
- High
- 2
- Medium
- 2
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Products
Latest featherplugins CVEs
Newest publication first
-
-
HighCVSS 8.1
The Feather Login Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getListOfUsers' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscr...
-
MediumCVSS 5.4
The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-l...
-
CVE-2023-2549 Feather Login Page 1.0.7 - 1.1.1 - Cross-Site Request Forgery to Privilege Escalation
PublishedHighCVSS 8.8The Feather Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions starting from 1.0.7 up to, and including, 1.1.1. This is due to missing nonce validation in the 'createTempAccountLink' function. This makes it possible for unauthenticated attacke...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.