Passwordless Login
Passwordless Login has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Passwordless Login has a vendor fix available, so running the current release closes it.
All of these findings were reported by stealthcopter. Passwordless Login is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2024-29143Passwordless Login <= 1.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Passwordless Login
Author
madalin.ungureanu
Passwordless Login is a modern way of loggin into your WordPress site without the use of a password. Join the discussion here: https://www.cozmoslabs.com/31550-wordpress-passwordless-login/ This is how it works: Instead of asking users for a password when they try to log in to your website, we simply ask them for their username or email The plugin creates a temporary authorization token and saves it in a WordPress transient that expires after 10 minutes Then we send the user an email with a link and the token The user clicks the link and sends the authorization code to your server The plugin then checks if the code is valid and creates the log in WordPress cookie, successfully authenticating the user. You can use the shortcode [passwordless-login] in a page or widget. If you’re looking to create front-end user registration and profile forms we recommend Profile Builder. NOTE: Passwordless Authentication dose not replace the default login functionality in WordPress.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C