Skip to content
PluginCanary

Clean Login

by Alberto Hornero · 5,000+ active installs · Checked 3 Nov 2026
Healthy3 Warnings

Healthy: vulnerability published 27 Oct 2026, fixed in 1.21.

86/ 100 Canary Score
Sub-scores for Clean Login
Ownership100
Maintenance100
Security80
Support70
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 27 Oct 2026, fixed in 1.21. Update to version 1.21 or later.27 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 16 Sep 2026, fixed in 1.19. Update to version 1.19 or later.16 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 16 Sep 2026, fixed in 1.19. Update to version 1.19 or later.16 Sep 2026Evidence
  • InfoSEC-34 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
hornero2 Jun 2014 to 19 Jul 2019, 101 commits
carazo22 Jul 2014 to 30 Oct 2026, 75 commits

2 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
5 days ago
Releases, 24 months
13
Tested up to
7.1 current
Requires PHP
not stated supported 8.2+
Releases per quarter for Clean Login
Q1 20240
Q2 20240
Q3 20242
Q4 20240
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20260
Q2 20264
Q3 20262
Q4 20267

Last release 30 Oct 2026. Tested with WordPress 7.1 (current).

Support

50% of 2 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
27 Oct 2026Clean Login <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook4.3<= 1.20.11.210
16 Sep 2026Clean Login <= 1.18 - Unauthenticated CAPTCHA Bypass5.3<= 1.181.190
16 Sep 2026Clean Login <= 1.18 - Unauthenticated Account Registration5.3<= 1.181.190
16 Jun 2026Clean Login <= 1.15 - Unauthenticated Insecure Direct Object Reference5.3<= 1.151.160
29 Aug 2024Clean Login <= 1.14.5 - Authenticated (Contributor+) Local File Inclusion8.8<= 1.14.51.14.60
10 Jan 2023Clean Login <= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 1.13.61.13.70
9 Aug 2021Clean Login 1.12.6.3 - Cross-Site Scripting6.11.12.6.31.12.6.40
29 Jun 2020Clean Login <= 1.10.3 - Cross-Site Request Forgery8.8<= 1.10.31.10.40
27 Jul 2015Clean Login <= 1.5 - Reflected Cross-Site Scripting6.1<= 1.51.5.1n/a

Source: Wordfence Intelligence.

Reputation

Lifetime rating 4.7 from 144 ratings. Quarterly trends appear as new reviews arrive.

Rating distribution
5 star124
4 star10
3 star4
2 star3
1 star3

Momentum

5,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Clean Login
4 May 2026398
11 May 2026378
18 May 2026451
25 May 2026274
1 Jun 2026224
8 Jun 20262,890
15 Jun 20261,422
22 Jun 2026434
29 Jun 2026466
6 Jul 20262,431
13 Jul 2026493
20 Jul 2026359
27 Jul 2026354
3 Aug 2026335
10 Aug 2026254
17 Aug 2026257
24 Aug 2026275
31 Aug 2026242
7 Sep 2026253
14 Sep 20262,592
21 Sep 2026721
28 Sep 20262,292
5 Oct 2026975
12 Oct 2026504
19 Oct 2026647
26 Oct 20267,908
2 Nov 2026226

Weekly downloads over the last 4 weeks are 123% above the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

LoginWP (Formerly Peter's Login Redirect)Score 92 · 80,000+Simple User AvatarScore 92 · 20,000+Gravatar Enhanced - Avatars, Profiles, and PrivacyScore 91 · 100,000+WP User AvatarsScore 91 · 20,000+Sidebar LoginScore 91 · 9,000+

Facts

Version2.0.1
AuthorAlberto Hornero
Added2 Jun 2014
Last updated30 Oct 2026
Active installs5,000+
Requires WordPress5.5
Tested up to7.1.4
Requires PHPnot stated
CategoryUser Management & Authentication > User Registration & Login
Tagslogin, registration, user profile, password reset, custom login page

Other plugins by this author: Akismet Notifier

Questions

Is Clean Login still maintained?

Clean Login was last updated on 30 Oct 2026. Its Canary status is Healthy.

Is Clean Login safe?

Clean Login has no open unpatched vulnerabilities on record. 4 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns Clean Login?

The wordpress.org author is Alberto Hornero. Recent committers: carazo, hornero, plugin-master. We have recorded no ownership change.

What can I use instead of Clean Login?

Plugins in the same category with a higher Canary Score: LoginWP (Formerly Peter's Login Redirect), Simple User Avatar, Gravatar Enhanced - Avatars, Profiles, and Privacy, WP User Avatars, Sidebar Login.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue