Clean Login
Clean Login has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2026; all 6 are fixed as of September 2026. Their average CVSS score is 6.9, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high.
The most common weakness is Cross-Site Scripting, behind 3 of the records (50%). Other recurring categories include Authorization Bypass Through User-Controlled Key, Cross-Site Request Forgery (CSRF).
Every one of the 6 issues recorded for Clean Login has a vendor fix available, so running the current release closes all known holes.
6 independent researchers contributed these findings, one record each. Clean Login is installed on roughly 6,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2024-8252Clean Login <= 1.14.5 - Authenticated (Contributor+) Local File Inclusion
Read the full analysisVulnerability Records

Clean Login
Author
Alberto Hornero
Try it out on your free dummy site: Click here => https://demo.tastewp.com/clean-login Clean Login lets you replace the default WordPress login and registration pages with fully customised frontend forms — no coding required. Place any form anywhere on your site using a simple shortcode. Whether you need a custom login page, a user registration form, a password reset page or an editable user profile, Clean Login has you covered with one shortcode per form: [clean-login] — Custom login form with show/hide password toggle [clean-login-register] — User registration form with CAPTCHA, reCAPTCHA and email validation [clean-login-edit] — Frontend user profile editor (name, email, password) [clean-login-restore] — Forgot password / password reset form [clean-login-change-password] — Dedicated password change form with visual strength meter [clean-login-logout] — Standalone logout link, usable anywhere on your site Why choose Clean Login? No coding — drop a shortcode into any page or post and the form appears instantly Fully responsive — forms adapt to any screen size and integrate with your theme’s CSS SEO friendly — login and registration pages are automatically marked as noindex and excluded from sitemaps, keeping your site’s SEO clean Secure — nonce verification on every form, honeypot antispam, CAPTCHA and Google reCAPTCHA support Password strength meter — visual indicator guides users to create stronger passwords WPML certified — official WPML compatibility for multilingual sites WooCommerce compatible — works alongside WooCommerce without conflicts Features Custom login page with redirect after login and logout Frontend user registration with optional email verification Forgot password / password reset via email link Dedicated change-password form with animated strength meter (Weak / Fair / Good / Strong) Frontend user profile editor — update name, email and password without visiting wp-admin Hide admin bar for selected roles Block dashboard access for non-admin users Standby role for new registrations — users stay inactive until an admin approves them Role selection at registration — let users choose their own role from a curated list Terms and conditions checkbox on registration form Use email address as username Automatic login after registration Customisable “Lost password?” link text from the settings panel Auto-linked forms — shortcodes detect each other and generate links automatically Override any template from your theme (theme/clean-login/ folder) AJAX compatible Usage and Settings Please, refer to Installation section
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C