CVE-2018-11366: Loginizer

Medium severity, CVSS 6.1. EPSS: 2.2% chance of exploitation in the next 30 days.

init.php in the Loginizer plugin 1.3.8 through 1.3.9 for WordPress has Unauthenticated Stored Cross-Site Scripting (XSS) because logging is mishandled. This is fixed in 1.4.0.

Affected products

• Loginizer Loginizer: version 1.3.8 only; version 1.3.9 only

Published 2018-05-22. Last modified 2026-06-17.