Ultimate AJAX Login
Ultimate AJAX Login has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for Ultimate AJAX Login has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Nguyen Xuan Chien. Ultimate AJAX Login is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.1.42.
CVE-2025-58854Ultimate AJAX Login <= 1.2.1 - Cross-Site Request Forgery
Read the full analysisVulnerability Records
Ultimate AJAX Login
Author
Samer Bechara
After testing all of the AJAX plugins in the WordPress repository, I got frustrated. They’re all great, but it seems that they’re like 90% complete. They still need polishing. This is why I decided to create this plugin How is this plugin different: Three different templates to choose from: Modal login form, Classic login form and popup login form (jQuery UI based) 24 themes to choose from (jQuery UI based) Fully customizable: Just copy the template you’re using from /templates/ directory in the plugin to the “ultimate_ajax_login” directory in your theme, and modify as you need to. After a user is logged in, nothing shows up. I found this pretty frustrating with other plugins, there was no way to hide things. If you need to show anything after a user logs in, just copy the template widget-logged-in.php to your ultimate_ajax_login folder and add whatever you need. You can call any WP function from there. Has three templates, one an AJAX-based classic login form, and the other is a jQuery UI dialog box (Tested and works on mobile), and the third one is a popmodal dialog box Blocks the login form whenever a user is being logged in. Allows you to specify a global login redirect URL in your settings page, which applies to all of your widgets. Login redirect URL can be overridden on a per-widget basis from the widget options page. Shortcode Usage Instead of using the widget, you can insert the shortcode inside any post. If you’re a theme developer, you can use it with the do_shortcode() function. Here are the varius option Using with classic template and no redirect url specified: [ultimate_ajax_login] Using the dialog box template: [ultimate_ajax_login template=’dialog’] Using the dialog box template and a jquery theme: [ultimate_ajax_login template=’dialog’ theme=’cupertino’]
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C