Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-19714

Simple JWT Login < 3.6.8 - Unauthenticated Account Takeover via Missing Google id_token Audience Validation

The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Login WordPress plugin before 3.6.8's Google sign-in enabled is affected.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Simple Jwt Login Project Wordpress
Products
Simple Jwt Login Wordpress
CVE-2021-24998

Simple JWT Login < 3.3.0 - Insecure Password Creation

The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the str_shuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic purposes" according to PHP's documentation.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Simple Jwt Login Project
Products
Simple Jwt Login
CVE-2021-24804

Simple JWT Login < 3.2.1 - Arbitrary Settings Update to Site Takeover via CSRF

The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site takeover.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Simple Jwt Login Project
Products
Simple Jwt Login