GCVE - cpe:2.3:a:codection:clean_login:*:*:*:*:*:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:codection:clean_login:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

Vendor	Codection (`b4db10ac-e484-5be3-b208-9c3d65027beb`)
Product	Clean Login (`e1c315f6-9e34-504f-8981-d17f874d2df6`)
Edition	*
Language	*
Software edition	*
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-8252`	vulnerable	2026-06-08 07:00:23.387881	Clean Login <= 1.14.5 - Authenticated (Contributor+) Local File Inclusion HIGH (8.8) The Clean Login plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.14.5 via the 'template' attribute of the clean-login-register shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Published: 2024-08-30T09:29:49.305Z Updated: 2026-04-08T17:18:10.869Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/b9f99b51-e1b1-4cd3-a9f7-24e4b59811a7?source=cve https://plugins.trac.wordpress.org/browser/clean-login/tags/1.14.5/include/shortcodes.php#L146 https://plugins.trac.wordpress.org/browser/clean-login/tags/1.14.5/include/frontend.php#L20 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3143241%40clean-login&new=3143241%40clean-login&sfp_email=&sfph_mail=	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-4838`	vulnerable	2026-06-08 05:52:00.461163	Clean Login < 1.13.7 - Contributor+ Stored XSS via Shortcode The Clean Login WordPress plugin before 1.13.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Published: 2023-02-06T19:59:19.786Z Updated: 2025-03-25T20:38:05.060Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/9937e369-60e8-451c-8790-1a83a59115fc	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-9336`	vulnerable	2026-06-08 05:07:13.580215	Details available The clean-login plugin before 1.5.1 for WordPress has reflected XSS. Published: 2019-08-22T12:20:43.000Z Updated: 2024-08-06T08:43:42.400Z Open on db.gcve.eu Reference links https://wordpress.org/plugins/clean-login/#developers	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.