Login With Ajax Vulnerabilities

The Login With Ajax – Fast Logins, 2FA, Redirects plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.1. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above...

CVSS:

6.4

Affected:

up to 4.5.1

Fix:

No patched version reported

Disclosed:

Aug 18, 2026

CVE-2026-66640 on NVD →

The Login With Ajax plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.1. This is due to missing or incorrect nonce validation on the dismiss_admin_notice() function. This makes it possible for unauthenticated attackers to dismiss notices via a forged request granted th...

CVSS:

4.3

Affected:

up to 4.1

Fixed in:

4.2

Disclosed:

Apr 10, 2024

CVE-2024-30546 on NVD →

The Login With Ajax plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on an unknown function in versions up to, and including, 4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 4.1

Fixed in:

4.2

Disclosed:

Dec 7, 2023

CVE-2023-49859 on NVD →

The Login With Ajax plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

CVSS:

5.4

Affected:

up to 3.1.6

Fixed in:

3.1.7

Disclosed:

Apr 11, 2017

Cross-site request forgery (CSRF) vulnerability in the Login With Ajax plugin before 3.1 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings.

CVSS:

6.3

Affected:

up to 3.1

Fixed in:

3.1

Disclosed:

May 6, 2013

CVE-2013-2707 on NVD →

Cross-site scripting (XSS) vulnerability in login-with-ajax.php in the Login With Ajax (aka login-with-ajax) plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the callback parameter in a lostpassword action to wp-login.php.

CVSS:

6.1

Affected:

up to 3.0.4

Fixed in:

3.0.4.1

Disclosed:

May 18, 2012

CVE-2012-2759 on NVD →

Cross-site scripting (XSS) vulnerability in the Login With Ajax plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the callback parameter.

CVSS:

6.1

Affected:

up to 3.0.4.1

Fixed in:

3.0.5

Disclosed:

May 7, 2012

CVE-2012-4283 on NVD →