Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-13
Simple Jwt Login - Security Vulnerability (CVE-2026-125836)
Cross-Site Request Forgery (CSRF) vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Cross Site Request Forgery.This issue affects Simple JWT Login: from n/a through 3.6.8.
PLUGIN
Simple Jwt Login
CVE-2026-125836
Risk Score
Threat Entry
Updated 2026-10-06
Simple Jwt Login - Security Vulnerability (CVE-2026-39793)
Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.
PLUGIN
Simple Jwt Login
CVE-2026-39793
Risk Score
Threat Entry
Updated 2026-08-26
Simple JWT Login - Improper Input Validation (CVE-2026-19714)
The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Login WordPress plugin before 3.6.8's Google sign-in enabled is affected.
PLUGIN
Simple JWT Login
CVE-2026-19714
Risk Score
Threat Entry
Updated 2026-07-13
Simple Jwt Login - Authentication Bypass (CVE-2026-14262)
The Simple JWT Login – Allows you to use JWT on REST endpoints. plugin for WordPress is vulnerable to Authentication Bypass to Privilege Escalation in all versions up to, and including, 3.6.6 via the `payload` parameter. The vulnerability exists because `AuthenticateService::generatePayload()` only overwrites JWT payload keys whose names appear in the admin-configured `jwt_payload` list — leaving any attacker-supplied identity claims such as `email`, `id`, or `username` intact and signed into the JWT with the site's HS256 secret. This makes it possible for authenticated attackers, with subscriber-level access and above, to…
PLUGIN
Simple Jwt Login
CVE-2026-14262
Risk Score
Threat Entry
Updated 2026-06-17
Simple Jwt Login - Cross-Site Scripting (XSS) (CVE-2025-58648)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Stored XSS.This issue affects Simple JWT Login: from n/a through
PLUGIN
Simple Jwt Login
CVE-2025-58648
Risk Score
Threat Entry
Updated 2026-06-17
Simple Jwt Login - Security Vulnerability (CVE-2021-24998)
The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the str_shuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic purposes" according to PHP's documentation.
PLUGIN
Simple Jwt Login
CVE-2021-24998
Risk Score
Threat Entry
Updated 2026-06-17
Simple Jwt Login - Cross-Site Request Forgery (CSRF) (CVE-2021-24804)
The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site takeover.
PLUGIN
Simple Jwt Login
CVE-2021-24804
Risk Score