Inactive Logout Vulnerabilities

The Inactive Logout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ina_redirect_page_individual_user' parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level ac...

CVSS:

6.4

Affected:

up to 3.5.5

Fixed in:

3.6.0

Disclosed:

Oct 31, 2025

CVE-2025-11922 on NVD →

The Inactive Logout plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ina_reset_adv_settings() function in versions up to, and including, 3.2.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to reset the plugin'...

CVSS:

5.3

Affected:

up to 3.2.3

Fixed in:

3.2.3

Disclosed:

Sep 20, 2023

CVE-2023-44142 on NVD →

The Inactive Logout plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the ina_reset_adv_settings() function in versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request, granted they can t...

CVSS:

4.3

Affected:

up to 3.2.3

Fixed in:

3.2.3

Disclosed:

Sep 20, 2023