Unknown Clean Login vulnerabilities

2 CVEs affecting Unknown Clean Login, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-90977, published 2026-09-18.

More from Unknown.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-90977, published 2026-09-18. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on…
• CVE-2026-90976, published 2026-09-18. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create…