Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-12
Defender Security - Security Vulnerability (CVE-2026-119040)
The Defender Security WordPress plugin before 6.4.1 does not limit the number of failed two-factor authentication attempts in its default configuration, allowing an attacker who already knows a victim's password to brute-force the one-time code and defeat the second authentication factor.
PLUGIN
Defender Security
CVE-2026-119040
Risk Score
Threat Entry
Updated 2026-11-12
Defender Security - Security Vulnerability (CVE-2026-119039)
The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout decisions actually originates from a trusted source, trusting a user-supplied value by default, allowing unauthenticated attackers to spoof their IP address and evade IP-based protections such as login lockout and IP banning, impersonate an allowlisted address, and poison the Defender Security WordPress plugin before 6.4.1's activity logs.
PLUGIN
Defender Security
CVE-2026-119039
Risk Score
Threat Entry
Updated 2026-08-28
Defender Security - Security Vulnerability (CVE-2026-19225)
The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
PLUGIN
Defender Security
CVE-2026-19225
Risk Score
Threat Entry
Updated 2026-06-17
Defender Security - Information Disclosure (CVE-2023-51490)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPMU DEV Defender Security – Malware Scanner, Login Security & Firewall.This issue affects Defender Security – Malware Scanner, Login Security & Firewall: from n/a through 4.1.0.
PLUGIN
Defender Security
CVE-2023-51490
Risk Score
Threat Entry
Updated 2026-06-17
Defender Security - Security Vulnerability (CVE-2023-5089)
The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.
PLUGIN
Defender Security
CVE-2023-5089
Risk Score
Threat Entry
Updated 2026-06-17
Defender Security - Cross-Site Request Forgery (CSRF) (CVE-2021-4425)
The Defender Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.6. This is due to missing or incorrect nonce validation on the verify_otp_login_time() function. This makes it possible for unauthenticated attackers to verify a one time login via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Defender Security
CVE-2021-4425
Risk Score