Vulnerabilities and security researches forwp-persistent-login wp-persistent-login

Jun 07, 2024

CVE, Research URL: b5ff565ad4dff71d4517b8cf1cfc64a3b9106994
Home page URL: Security reports for WordPress Persistent Login
Application: WordPress Persistent Login
Date: Feb 28, 2022
Research Description: Persistent Login [wp-persistent-login] < 2.0.0 WordPress WordPress Persistent Login plugin <= 1.3.23 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability discovered in WordPress WordPress Persistent Login plugin (versions <= 1.3.23).
Affected versions: max 2.0.0.
Status: vulnerable

Nov 14, 2024

CVE, Research URL: CVE-2022-4974
Home page URL: Security reports for WordPress Persistent Login
Application: WordPress Persistent Login
Date: Oct 16, 2024
Research Description: The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.
Affected versions: max 2.0.0.
Status: vulnerable

Jun 16, 2026

CVE, Research URL: 6d8910c719b2a132ec93828cd37e418b19cac960
Home page URL: Security reports for WordPress Persistent Login
Application: WordPress Persistent Login
Date: Mar 04, 2022
Research Description: Persistent Login [wp-persistent-login] < 2.0.0 Freemius SDK <= 2.4.2 - Missing Authorization Checks The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.
Affected versions: max 2.0.0.
Status: vulnerable

CVE, Research URL: 2c88a2fecf5bbc2c78c9e7c40b352a2735bfcd42
Home page URL: Security reports for WordPress Persistent Login
Application: WordPress Persistent Login
Date: Feb 28, 2022
Research Description: Persistent Login [wp-persistent-login] < 2.0.0 WordPress WordPress Persistent Login plugin <= 1.3.23 - Sensitive Information Disclosure vulnerability Sensitive Information Disclosure vulnerability discovered in WordPress WordPress Persistent Login plugin (versions <= 1.3.23).
Affected versions: max 2.0.0.
Status: vulnerable

Aug 22, 2026

CVE, Research URL: CVE-2026-66594
Home page URL: Security reports for WordPress Persistent Login
Application: WordPress Persistent Login
Date: Aug 20, 2026
Research Description: Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.
Affected versions: max 3.1.1.
Status: vulnerable

Sep 02, 2026

CVE, Research URL: CVE-2026-18752
Home page URL: Security reports for WordPress Persistent Login
Application: WordPress Persistent Login
Date: Sep 01, 2026
Research Description: The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppl_device_id' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is only exploitable when the plugin's Login History feature is enabled.
Affected versions: max 3.1.1.
Status: vulnerable