Zm Ajax Login Register Vulnerabilities

The ZM Ajax Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.2. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing...

CVSS:

9.8

Affected:

up to 2.0.2

Fix:

No patched version reported

Disclosed:

Apr 14, 2023

CVE-2023-2027 on NVD →

Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a load_template action to wp-admin/admin-ajax.php.

CVSS:

9.8

Affected:

up to 1.1.0

Fixed in:

1.1.0

Disclosed:

Jun 5, 2015

CVE-2015-4153 on NVD →

Cross-site scripting (XSS) vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS:

6.1

Affected:

up to 1.0.9

Fixed in:

1.1.0

Disclosed:

Jun 4, 2015

CVE-2015-4465 on NVD →