Easy Hide Login Vulnerabilities

The Easy Hide Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbit...

CVSS:

4.4

Affected:

up to 1.0.7

Fixed in:

1.0.8

Disclosed:

May 9, 2023

CVE-2023-32505 on NVD →

The Easy Hide Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.8. This is due to missing or incorrect nonce validation on the wp_hide_login_plugin_options function. This makes it possible for unauthenticated attackers to change the plugin's settings via a forg...

CVSS:

4.3

Affected:

up to 1.0.8

Fixed in:

1.0.9

Disclosed:

May 9, 2023

CVE-2023-31075 on NVD →