PLUGIN SECURITY
Is Login Customizer safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the Login Customizer WordPress plugin — checked against WP Clinic's local security database.
Plugin details
- Slug:
login-customizer - Requires PHP: 5.6+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
- Custom Login Page Customizer [login-customizer] < 2.1.8 [WordPress Custom Login Page Customizer plugin <= 2.1.7 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability]
- Custom Login Page Customizer [login-customizer] < 2.1.8 [WordPress Custom Login Page Customizer plugin <= 2.1.7 - Sensitive Information Disclosure vulnerability]
- Custom Login Page Customizer [login-customizer] < 2.1.8 [Freemius SDK <= 2.4.2 - Missing Authorization Checks]
- Custom Login Page Customizer [login-customizer] < 2.2.3 [CVE-2023-33999, WordPress Custom Login Page Customizer Plugin <= 2.2.2 is vulnerable to Cross Site Scripting (XSS), Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting]
- Custom Login Page Customizer [login-customizer] < 2.5.4 [CVE-2025-14975, Custom Login Page Customizer <= 2.5.3 - Unauthenticated Privilege Escalation via Password Reset]
Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.
Safer / more established alternatives
- LoginPress | wp-login Custom Login Page Customizer — 200000+ active installs — max PHP 8.4
- Customizer Export/Import — 100000+ active installs — max PHP 8.4
- All In One Login — Login Page Security and Customization for WordPress with Google reCAPTCHA, Social Login, Temporary Login, 2FA, and more. — 60000+ active installs — max PHP 8.4
- Customizer Search — 50000+ active installs — max PHP 8.4
- Custom Login Page Customizer – Login Designer — 30000+ active installs
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.