VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 7 known issues Latest disclosed Jun 19, 2025

Login & Register Customizer – Popup | Slider | Inline | WooCommerce Vulnerabilities

Review known vulnerability records for the WordPress plugin Login & Register Customizer – Popup | Slider | Inline | WooCommerce (`easy-login-woocommerce`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2025-50027, CVE-2025-1064 and CVE-2024-5665, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
7
High or Critical
2
Patch Coverage
100%
Last Updated
Jul 10, 2025
Related Security Guides

Use these guides while reviewing Login & Register Customizer – Popup | Slider | Inline | WooCommerce fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize Login & Register Customizer – Popup | Slider | Inline | WooCommerce remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
5
1. Match the Package
Confirm the installed WordPress plugin slug is easy-login-woocommerce before acting on any CVE from this cluster.
2. Sort by Severity
Start with 2 high or critical records, then review medium and unrated findings with public references.
3. Check Patch Evidence
7 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2022-0215 High
Cross-Site Request Forgery remediation for Login & Register Customizer – Popup | Slider | Inline | WooCommerce

Affected range: Versions up to 2.2. Fixed version: 2.3.

CVE-2020-36715 High
Authorization Bypass remediation for Login & Register Customizer – Popup | Slider | Inline | WooCommerce

Affected range: Versions before 1.5. Fixed version: 1.5.

CVE-2025-1064 Medium
Stored Cross-Site Scripting remediation for Login & Register Customizer – Popup | Slider | Inline | WooCommerce

Affected range: Versions up to 2.8.5. Fixed version: 2.8.6.

CVE-2025-50027 Medium
Stored Cross-Site Scripting remediation for Login & Register Customizer – Popup | Slider | Inline | WooCommerce

Affected range: Versions up to 2.9.4. Fixed version: 2.9.5.

Priority CVE Quick Links

Fast paths into Login & Register Customizer – Popup | Slider | Inline | WooCommerce CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
5
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2022-0215
Login/Signup Popup <= 2.2 - Cross-Site Request Forgery to Arbitrary Options Update
 Cross-Site Request Forgery Versions up to 2.2 2.3 CVSS 8.8
CVE-2020-36715
Login/Signup Popup < 1.5 - Missing Authorization
 Authorization Bypass Versions before 1.5 1.5 CVSS 7.4
CVE-2025-1064
Login/Signup Popup ( Inline Form + Woocommerce ) <= 2.8.5 - Authenticated (Contribut...
 Stored Cross-Site Scripting Versions up to 2.8.5 2.8.6 CVSS 6.4
CVE-2025-50027
Login/Signup Popup <= 2.9.4 - Authenticated (Administrator+) Stored Cross-Site Scrip...
 Stored Cross-Site Scripting Versions up to 2.9.4 2.9.5 CVSS 4.4
CVE-2024-5665
Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 - 2.7.2 - Missing Authorizati...
 Vulnerability 2.7.1 through 2.7.2 2.7.3 CVSS 4.3
CVE-2022-0215 High 2.3
CVE-2022-0215 Login & Register Customizer – Popup | Slider | Inline | WooCommerce Cross-Site Request Forgery

Login/Signup Popup <= 2.2 - Cross-Site Request Forgery to Arbitrary Options Update

CVE-2020-36715 High 1.5
CVE-2020-36715 Login & Register Customizer – Popup | Slider | Inline | WooCommerce Authorization Bypass

Login/Signup Popup < 1.5 - Missing Authorization

CVE-2025-1064 Medium 2.8.6
CVE-2025-1064 Login & Register Customizer – Popup | Slider | Inline | WooCommerce Stored Cross-Site Scripting

Login/Signup Popup ( Inline Form + Woocommerce ) <= 2.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action Shortcode

CVE-2025-50027 Medium 2.9.5
CVE-2025-50027 Login & Register Customizer – Popup | Slider | Inline | WooCommerce Stored Cross-Site Scripting

Login/Signup Popup <= 2.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

CVE-2024-5665 Medium 2.7.3
CVE-2024-5665 Login & Register Customizer – Popup | Slider | Inline | WooCommerce Vulnerability

Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Exposure

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for Login & Register Customizer – Popup | Slider | Inline | WooCommerce so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
7 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
0 critical and 2 high severity findings.
Recent CVEs
CVE-2025-50027, CVE-2025-1064 and CVE-2024-5665
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Login & Register Customizer – Popup | Slider | Inline | WooCommerce

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2025-50027
CVE-2025-50027: Login/Signup Popup <= 2.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Login/Signup Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and abo...

Published
Jun 19, 2025
Patched Release
2.9.5
Affected Versions
Versions up to 2.9.4
Next Step
Update to 2.9.5 or newer if supported.
Review CVE-2025-50027 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-1064
CVE-2025-1064: Login/Signup Popup ( Inline Form + Woocommerce ) <= 2.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action Shortcode

The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xoo_el_action shortcode in all versions up to, and including, 2.8.5 due to insufficient input sanitization and output escaping on user supplied...

Published
Feb 19, 2025
Patched Release
2.8.6
Affected Versions
Versions up to 2.8.5
Next Step
Update to 2.8.6 or newer if supported.
Review CVE-2025-1064 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-5665
CVE-2024-5665: Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Exposure

The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ‘export_settings’ function in versions 2.7.1 to 2.7.2. This makes it possible for authenticated attackers, with Subscrib...

Published
Jun 05, 2024
Patched Release
2.7.3
Affected Versions
2.7.1 through 2.7.2
Next Step
Update to 2.7.3 or newer if supported.
Review CVE-2024-5665 fixed version details Open CVE Reference
Plugin Medium Patched: Yes
Login/Signup Popup <= 2.3 - Cross-Site Request Forgery to Settings Reset

The Login/Signup Popup plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3. This is due to missing nonce validation on the reset_settings() function. This makes it possible for unauthenticated attackers to reset the plugin's sett...

Published
Jun 26, 2023
Patched Release
2.4
Affected Versions
Versions before 2.4
Next Step
Update to 2.4 or newer if supported.
Review Login & Register Customizer – Popup | Slider | Inline | WooCommerce vulnerability details
Plugin High Patched: Yes CVE-2022-0215
CVE-2022-0215: Login/Signup Popup <= 2.2 - Cross-Site Request Forgery to Arbitrary Options Update

The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the save_settings function found in the ~/includes/xoo-framework/admin/class-xoo-admin-settings.p...

Published
Jan 13, 2022
Patched Release
2.3
Affected Versions
Versions up to 2.2
Next Step
Update to 2.3 or newer if supported.
Review CVE-2022-0215 fixed version details Open CVE Reference
Plugin Medium Patched: Yes
Login/Signup Popup ( Inline Form + Woocommerce ) <= 2.1 - Reflected Cross-Site Scripting

The plugin Login/Signup Popup ( Inline Form + Woocommerce ) for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthent...

Published
Nov 17, 2021
Patched Release
2.2
Affected Versions
Versions up to 2.1
Next Step
Update to 2.2 or newer if supported.
Review Login & Register Customizer – Popup | Slider | Inline | WooCommerce vulnerability details
Plugin High Patched: Yes CVE-2020-36715
CVE-2020-36715: Login/Signup Popup < 1.5 - Missing Authorization

The Login/Signup Popup plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in versions up to, and including, 1.4. This makes it possible for authenticated attackers to inject arbitrary web scripts into the plugin settin...

Published
May 14, 2020
Patched Release
1.5
Affected Versions
Versions before 1.5
Next Step
Update to 1.5 or newer if supported.
Review CVE-2020-36715 fixed version details Open CVE Reference