Unknown Login & Register Forms vulnerabilities

4 CVEs affecting Unknown Login & Register Forms, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-18470, published 2026-08-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-18470, published 2026-08-10. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its…
CVE-2026-18469, published 2026-08-10. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source…
CVE-2026-18468, published 2026-08-10. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it…
CVE-2026-14836, published 2026-08-01. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both the verification code and the per-source…