Authentication WordPress Plugins That Need Review
38 indexed plugins
Plugins
38
Active Installs
671k+
Average Score
55
Audited
38
Needs Review
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1 | Next Active Directory Integration | 23 | 683 | 284 | 2k+ | Exception output is not escaped | ||
| #2 | WP-Members Membership Plugin | 24 | 669 | 382 | 50k+ | Output is not escaped | ||
| #3 | Login for Google Apps | 27 | 139 | 85 | 10k+ | Exception output is not escaped | ||
| #4 | WP 2-step verification | 32 | 154 | 65 | 1k+ | Output is not escaped | ||
| #5 | wpDirAuth | 32 | 250 | 135 | 500 | wp function not compatible with requires wp | ||
| #6 | Sessions | 33 | 196 | 103 | 900 | Output is not escaped | ||
| #7 | HTTP Authentication | 35 | 23 | 6 | 600 | Output is not escaped | ||
| #8 | IP Based Login | 35 | 179 | 146 | 600 | Output is not escaped | ||
| #9 | Keyring | 35 | 233 | 203 | 1k+ | Output is not escaped | ||
| #10 | Log in with Google | 35 | 5 | 17 | 6k+ | Non-prefixed global variable | ||
| #11 | WP Cassify | 35 | 106 | 143 | 700 | Missing nonce verification | ||
| #12 | Login by Auth0 | 37 | 307 | 82 | 10k+ | Text Domain Mismatch | ||
| #13 | authLdap | 37 | 46 | 30 | 4k+ | Exception output is not escaped | ||
| #14 | Duo Two-Factor Authentication | 37 | 44 | 61 | 3k+ | Missing nonce verification | ||
| #15 | Simple LDAP Login | 38 | 65 | 33 | 1k+ | Output is not escaped | ||
| #16 | WP Limit Login Attempts | 39 | 26 | 67 | 10k+ | Direct Query | ||
| #17 | WPS Limit Login | 39 | 152 | 76 | 100k+ | Output is not escaped | ||
| #18 | Limit Login Attempts | 40 | 81 | 38 | 300k+ | Output is not escaped | ||
| #19 | yubikey-plugin | 40 | 64 | 33 | 400 | Text Domain Mismatch | ||
| #20 | Google Authenticator | 41 | 39 | 65 | 20k+ | Output is not escaped | ||
| #21 | Two Factor | 42 | 18 | 70 | 100k+ | Nonce verification recommended | ||
| #22 | Passwords Evolved | 45 | 26 | 17 | 1k+ | Output is not escaped | ||
| #23 | Easy Basic Authentication – Add basic auth to site or admin area | 46 | 14 | 28 | 600 | Input is not sanitized | ||
| #24 | Whitelist IP For Limit Login Attempts | 48 | 18 | 12 | 500 | Output is not escaped | ||
| #25 | JSON API User | 57 | 17 | 34 | 1k+ | Non-prefixed hook name | ||
| #26 | Two Factor (2FA) Authentication via Email | 61 | 12 | 27 | 9k+ | Request data is not unslashed | ||
| #27 | Authorizer | 65 | 3 | 54 | 5k+ | Nonce verification recommended | ||
| #28 | WP SAML Auth | 76 | 7 | 25 | 8k+ | Nonce verification recommended | ||
| #29 | Duo Universal | 80 | 6 | 25 | 2k+ | Nonce verification recommended | ||
| #30 | Maestro Connector | 97 | 7 | 4 | 500 | Missing direct file access protection | ||
| #31 | HivePress Authentication | 98 | 1 | 5 | 1k+ | Missing Version | ||
| #32 | miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) | 99 | 6 | 10k+ | Non-prefixed constant | |||
| #33 | Firebase Authentication | 100 | 2 | 500 | slow db query meta key | |||
| #34 | Active Directory Integration / LDAP Integration | 100 | 2 | 4k+ | Non-prefixed constant | |||
| #35 | Protect Login | 100 | 0 | 600 | No open findings | |||
| #36 | Shibboleth | 100 | 0 | 3k+ | No open findings | |||
| #37 | WP Basic Authentication | 100 | 3 | 2k+ | trademarked term | |||
| #38 | Logged-in-only | 100 | 1 | 700 | trademarked term |
