See how clean login compares to other vendors in security performance
The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capability check on the CleanLoginShortcode::getpageswithshortcodes() function hooked to the savepost action. This makes it possible for authenticated attackers, with Contributor-level access and above, to overwrite the plugin's clloginurl/clloginid/clregisterurl/clregisterid/clrestoreurl/clrestoreid/clediturl/cleditid/clchangepasswordurl/clchangepasswordid options with the ID and permalink of a post they themselves authored — simply by embedding the plugin's shortcodes in their own post content.