Now officially on WordPress.org

CVE Database / CVE-2025-50027

CVE · Medium

CVE-2025-50027 — Login & Register Forms – Popup, Slider, Profile & WooCommerce [easy-login-woocommerce] < 2.9.5

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2025-50027 Login & Register Forms – Popup, Slider, Profile & WooCommerce [easy-login-woocommerce] < 2.9.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 5.9 < 2.9.5 2.9.5 2025-06-19 —

CVE-2025-50027

A stored cross-site scripting vulnerability exists in the Login/Signup Popup plugin for WordPress, affecting versions up to 2.9.4. The issue arises from inadequate input validation and output encoding, allowing an authenticated attacker with administrator-level access to inject malicious scripts that will execute when a user accesses the injected page. This vulnerability specifically impacts multi-site installations where unfiltered HTML has been restricted.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings