Loading story…
An authenticated stored cross-site scripting vulnerability in the WordPress Login/Signup Popup plugin allowed logged-in users to inject JavaScript into plugin settings and target administrators in the WordPress backend. Tracked as CVE-2020-36715, the flaw affects versions earlier than 1.5 of the plugin, also identified as easy-login-woocommerce. Missing capability checks and a security nonce exposed the settings through the plugin’s AJAX API. WPScan assigns the vulnerability a critical CVSS score of 9.9.
The vulnerability was publicly disclosed on May 14, 2020, and WPScan reports that exploitation had already been occurring for a couple of days. NinTechNet also reported the fix for the zero-day vulnerability. Version 1.5 fixes the flaw; organizations still running an affected version should upgrade to a current supported release and review plugin settings for injected JavaScript, particularly where untrusted users can register or authenticate.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
The vulnerability tracked as CVE-2020-36715 was publicly disclosed and added to the vulnerability database. The record credits Jerome Braundet of NinTechNet as the original researcher and assigns a critical CVSS score of 9.9.
Version 1.5 of Login/Signup Popup fixed the authenticated stored cross-site scripting vulnerability affecting earlier versions of the easy-login-woocommerce plugin.
An authenticated stored cross-site scripting vulnerability in the WordPress Login/Signup Popup plugin had been exploited for a couple of days at the time of disclosure. Missing capability checks and a security nonce allowed authenticated users to inject JavaScript into plugin settings through the AJAX API and target administrators.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical broken access control vulnerability in the WordPress Flo Forms plugin allowed authenticated, low-privilege users to change plugin options and inject malicious JavaScript into the administrative backend. Tracked as **CVE-2021-4367**, the flaw affects versions earlier than **1.0.36** and involves the `flo_import_forms_options` AJAX action. WPScan lists the vulnerability as actively exploited, with a CVSS score of **9.9**; NinTechNet also reported a zero-day fix for the plugin. Version **1.0.36** fixes the vulnerability. Organizations running affected versions should upgrade to that release or a newer supported version and review imported form options for unauthorized changes or injected JavaScript. Because exploitation requires authentication but not administrator privileges, sites with untrusted low-privilege accounts are exposed. Stored scripts in the backend could execute when an administrator views affected content, putting privileged sessions at risk.
Aug 27, 2026
Active exploitation has been reported against **CVE-2026-1492** in the *User Registration & Membership* WordPress plugin (WPEverest), allowing **unauthenticated privilege escalation** by submitting a user-controlled role value during membership registration. The flaw affects versions **through 5.1.2** and enables attackers to create **administrator** accounts, which can then be used to install plugins/themes, modify PHP code and security settings, exfiltrate site/user data, and potentially implant malware or backdoors. Wordfence/Defiant telemetry cited in reporting indicates exploitation attempts were observed and blocked at scale in customer environments. A fix was released in **5.1.3** (with **5.1.4** available), and the recommended mitigation is to **update immediately** or temporarily disable/uninstall the plugin if patching is not possible. Other WordPress plugin CVEs in the provided material—**CVE-2026-1321** (*Restrict Content* unauth privilege escalation via `rcp_level`), **CVE-2026-1720** (*WowOptin* missing authorization enabling Subscriber+ arbitrary plugin installation), and **CVE-2026-2628** (*All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login* authentication bypass)—are separate issues and should be tracked independently, as they do not describe the same exploited vulnerability affecting *User Registration & Membership* (CVE-2026-1492).
Mar 5, 2026
Threat actors are actively exploiting critical vulnerabilities in popular WordPress plugins and themes, enabling the hijacking of administrator accounts and full site compromise. The Post SMTP plugin, installed on over 400,000 WordPress sites, is affected by CVE-2025-11833, a flaw that allows unauthenticated attackers to read arbitrary logged emails, including password reset messages, due to missing authorization checks. This exposure enables attackers to reset admin passwords and take over sites. Wordfence has observed over 4,500 exploit attempts since November 1, and a patch was released in version 3.6.1, but a significant number of sites remain unpatched and vulnerable. Similarly, the JobMonster WordPress theme is being targeted via CVE-2025-5397, an authentication bypass vulnerability that allows attackers to hijack admin accounts when social login is enabled. The flaw arises from improper verification in the `check_login()` function, letting attackers fake admin access if they know the username or email. The issue is fixed in version 4.8.2, and users are urged to update, disable social login, and enable two-factor authentication. These incidents highlight the ongoing risk posed by unpatched WordPress components and the need for immediate mitigation to prevent site compromise.
Nov 4, 2025