WordPress plugin
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 19 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High7
- Medium11
- Low1
All Kadence Security – Password, Two Factor Authentication, and Brute Force Protection vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | IP Address Spoofing to Denial of Service ≤9.3.1Update to 9.3.2 | CVE-2022-44593 | |
| Medium5.3 | Unauthenticated Login Page Disclosure ≤9.0.0Update to 9.0.1 | — | |
| Medium4.7 | Open Redirection via redirect_to_https ≤8.1.4Update to 8.1.5 | CVE-2023-28786 | |
| Medium5.3 | Hidden Login Bypass <7.9.1Update to 7.9.1 | — | |
| High7.5 | Broken Password Mechanism ≤7.6.1Update to 7.7.0 | CVE-2020-36176 | |
| High7.2 | Authenticated SQL Injection <7.0.3Update to 7.0.3 | CVE-2018-12636 | |
| High7.5 | Cross-Site Scripting ≤6.9.0Update to 6.9.1 | CVE-2018-7433 | |
| Medium6.4 | Stored Cross-Site Scripting <5.6.2Update to 5.6.2 | — | |
| Medium5.3 | Sensitive Information Exposure via Diff Response ≤5.6.1Update to 5.6.2 | — | |
| High7.4 | Missing Capabilities Check <5.3.6Update to 5.3.6 | — | |
| Medium5.3 | Insecure Backup/Logfile Generation <5.3.1Update to 5.3.1 | — | |
| Low3.3 | Authenticated Cross-Site Scripting <5.3.5Update to 5.3.5 | — | |
| Medium6.5 | Stored Cross-Site Scripting <4.6.13Update to 4.6.13 | — | |
| Medium6.4 | Stored Cross-Site Scripting ≤3.6.3Update to 3.6.4 | — | |
| High7.2 | Stored Cross-Site Scripting ≤3.5.3Update to 3.5.4 | — | |
| High8.3 | Stored Cross-Site Scripting <3.6.4Update to 3.6.4 | — | |
| Medium6.5 | Cross-Site Scripting <3.4.4Update to 3.4.4 | — | |
| Medium6.1 | Multiple Cross-Site Scripting ≤3.2.4Update to 3.2.5 | CVE-2012-4264 | |
| High7.2 | Cross-Site Scripting <3.2.5Update to 3.2.5 | CVE-2012-4263 |
- Medium5.3IP Address Spoofing to Denial of Service
≤9.3.1Update to 9.3.2
- Medium5.3Unauthenticated Login Page Disclosure
≤9.0.0Update to 9.0.1
- Medium4.7Open Redirection via redirect_to_https
≤8.1.4Update to 8.1.5
- Medium5.3Hidden Login Bypass
<7.9.1Update to 7.9.1
- High7.5Broken Password Mechanism
≤7.6.1Update to 7.7.0
- High7.2Authenticated SQL Injection
<7.0.3Update to 7.0.3
- High7.5Cross-Site Scripting
≤6.9.0Update to 6.9.1
- Medium6.4Stored Cross-Site Scripting
<5.6.2Update to 5.6.2
- Medium5.3Sensitive Information Exposure via Diff Response
≤5.6.1Update to 5.6.2
- High7.4Missing Capabilities Check
<5.3.6Update to 5.3.6
- Medium5.3Insecure Backup/Logfile Generation
<5.3.1Update to 5.3.1
- Low3.3Authenticated Cross-Site Scripting
<5.3.5Update to 5.3.5
- Medium6.5Stored Cross-Site Scripting
<4.6.13Update to 4.6.13
- Medium6.4Stored Cross-Site Scripting
≤3.6.3Update to 3.6.4
- High7.2Stored Cross-Site Scripting
≤3.5.3Update to 3.5.4
- High8.3Stored Cross-Site Scripting
<3.6.4Update to 3.6.4
- Medium6.5Cross-Site Scripting
<3.4.4Update to 3.4.4
- Medium6.1Multiple Cross-Site Scripting
≤3.2.4Update to 3.2.5
- High7.2Cross-Site Scripting
<3.2.5Update to 3.2.5
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection: common questions
Does Kadence Security – Password, Two Factor Authentication, and Brute Force Protection have known vulnerabilities?
Yes. VulnCrest Radar lists 19 known vulnerabilities in Kadence Security – Password, Two Factor Authentication, and Brute Force Protection: 7 high, 11 medium, 1 low. None are known to affect version null.
How do I check which version of Kadence Security – Password, Two Factor Authentication, and Brute Force Protection I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Kadence Security – Password, Two Factor Authentication, and Brute Force Protection vulnerability?
CVE-2022-44593, published Jun 20, 2024: Solid Security <= 9.3.1 - IP Address Spoofing to Denial of Service. Severity: Medium (CVSS 5.3).
Is any Kadence Security – Password, Two Factor Authentication, and Brute Force Protection vulnerability listed in CISA KEV?
No. None of the known Kadence Security – Password, Two Factor Authentication, and Brute Force Protection vulnerabilities is currently listed in the CISA KEV catalog.