Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-08
CVE-2026-14495 - Dologin Security Plugin
The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Randomness in all versions up to, and including, 4.3. The vulnerability exists because `dologin\s::rrand()` seeds the Mersenne Twister with `mt_srand((double) microtime() * 1000000)` — discarding the integer-seconds component of `microtime()` and constraining the seed to a range of approximately 10^6 values (~20 bits of entropy) — after which every character of the 32-character magic-link token is drawn sequentially with `mt_rand()`, making the entire token a deterministic function of that seed. Because `Pswdless::try_login()` is registered on the unauthenticated…
PLUGIN
Dologin Security
CVE-2026-14495
Risk Score
Threat Entry
Updated 2025-03-06
CVE-2023-4800 - Dologin Security Plugin
The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users.
PLUGIN
Dologin Security
CVE-2023-4800
Risk Score
Threat Entry
Updated 2026-03-03
CVE-2023-4549 - Dologin Security Plugin
The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form.
PLUGIN
Dologin Security
CVE-2023-4549
Risk Score
Threat Entry
Updated 2026-03-03
CVE-2023-4631 - Dologin Security Plugin
The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing.
PLUGIN
Dologin Security
CVE-2023-4631
Risk Score