Skip to content
PluginCanary

Login & Register Customizer

Login & Register Customizer - Forms, Popup, Profile & WooCommerce
by xootix · 30,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 30 Sep 2026, 40 releases in 24 months, no unpatched vulnerabilities.

80/ 100 Canary Score
Sub-scores for Login & Register Customizer
Ownership100
Maintenance100
Security60
Support70
Reputation60

How the score works

Quick answers

Is Login & Register Customizer still maintained?
Yes. Last release 30 Sep 2026, 40 releases in the last 24 months. 30 Sep 2026 · wordpress.org
Who owns Login & Register Customizer, and has it changed hands?
No change recorded. Main committer xootix since Apr 2018. 4 Nov 2026 · SVN log
Was Login & Register Customizer removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Login & Register Customizer safe?
12 known vulnerabilities, all fixed (latest in 3.2.5). Not on the exploited list. 6 Aug 2026 · Wordfence Intelligence
Is the latest Login & Register Customizer update safe to install?
No ownership change before 4.0.4. No one-star spike after it. 9 Sep 2026 · Release history

Active signals

Facts we detected, with links to the source.

  • InfoMOM-2Downloads in the last 4 weeks are down more than half vs the 26-week average. Review this plugin.3 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
xootix4 Apr 2018 to 20 Oct 2026, 293 commits

1 committer recorded. No ownership change since 2018.

Maintenance

Last release
35 days ago
Releases, 24 months
40
Tested up to
7.1 current
Requires PHP
not stated supported 8.2+
Releases per quarter
Releases per quarter for Login & Register Customizer
Q1 20245
Q2 20246
Q3 20245
Q4 20246
Q1 20253
Q2 20258
Q3 20251
Q4 20256
Q1 20263
Q2 20262
Q3 202613
Q4 20260

Last release 30 Sep 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 4.8.

Average rating per quarter for Login & Register Customizer
Q4 20245.0
Q1 20255.0
Q2 20254.2
Q3 20254.0
Q4 20255.0
Q1 20265.0
Q2 20265.0
Q3 20265.0

Average rating stayed at 5.0 between Q4 2024 and Q3 2026.

Rating distribution
5 star232
4 star6
3 star3
2 star4
1 star9
Latest low reviews

Security record

6 vulnerabilities in 24 months (12 on record), all patched (latest fixed in 3.2.5).

Show 12 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
6 Aug 2026Login & Register Forms - Popup, Slider, Profile & WooCommerce < 3.2.5 - Authentication Bypass via Brute Force8.1< 3.2.53.2.5Patched before disclosure
5 Aug 2026Login & Register Forms <= 4.0.1 - Unauthenticated Privilege Escalation via Account Takeover9.8<= 4.0.14.0.2Patched before disclosure
5 Aug 2026Login & Register Forms <= 4.0.1 - Unauthenticated Account Takeover via Brute Force Password Reset Code8.1<= 4.0.14.0.2Patched before disclosure
5 Aug 2026Login & Register Forms <= 4.0.1 - Unauthenticated Registered User Email Address Disclosure5.3<= 4.0.14.0.2Patched before disclosure
19 Jun 2025Login/Signup Popup <= 2.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 2.9.42.9.56
19 Feb 2025Login/Signup Popup ( Inline Form + Woocommerce ) <= 2.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action Shortcode6.4<= 2.8.52.8.6Patched before disclosure
5 Jun 2024Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Exposure4.32.7.1 to 2.7.22.7.3Patched before disclosure
5 Jun 2024XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update8.82.7.1 to 2.7.22.7.3Patched before disclosure
26 Jun 2023Login/Signup Popup <= 2.3 - Cross-Site Request Forgery to Settings Reset4.3< 2.42.4Patched before disclosure
13 Jan 2022Login/Signup Popup <= 2.2 - Cross-Site Request Forgery to Arbitrary Options Update8.8<= 2.22.3Patched before disclosure
17 Nov 2021Login/Signup Popup ( Inline Form + Woocommerce ) <= 2.1 - Reflected Cross-Site Scripting6.1<= 2.12.2Patched before disclosure
14 May 2020Login/Signup Popup < 1.5 - Missing Authorization7.4< 1.51.51

Changelog mentions of security fixes: 4.0.1 (nonce); 4.0.2 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

50% of 2 support threads resolved in the last 2 months.

Momentum

30,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Login & Register Customizer
4 May 2026645
11 May 20261,112
18 May 20261,080
25 May 20261,029
1 Jun 2026966
8 Jun 202611,227
15 Jun 20262,919
22 Jun 20262,156
29 Jun 20261,837
6 Jul 202620,931
13 Jul 202629,436
20 Jul 202612,026
27 Jul 202619,016
3 Aug 20266,656
10 Aug 20263,531
17 Aug 20262,355
24 Aug 20269,802
31 Aug 20264,529
7 Sep 202611,660
14 Sep 20264,083
21 Sep 20262,498
28 Sep 20261,899
5 Oct 20261,638
12 Oct 20261,659
19 Oct 20261,796
26 Oct 20261,661
2 Nov 2026238

Weekly downloads over the last 4 weeks are 77% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

LoginWP (Formerly Peter's LoginScore 92 · 80,000+Simple User AvatarScore 92 · 20,000+Gravatar EnhancedScore 91 · 100,000+WP User AvatarsScore 91 · 20,000+One User AvatarScore 89 · 100,000+

Facts

Version4.0.4
Authorxootix
Added4 Apr 2018
Last updated30 Sep 2026
Active installs30,000+
Requires WordPress3.0.1
Tested up to7.1.4
Requires PHPnot stated
CategoryUser Management & Authentication > User Registration & Login
Tagsotp login, custom login, social login, login customizer, woocommerce login

Other plugins by this author: Side Cart Woocommerce | Woocommerce Cart, Cart Popup for WooCommerce, Waitlist Woocommerce ( Back in stock notifier ), OTP Login & Register Woocommerce, Quick View WooCommerce

Questions

Is Login & Register Customizer still maintained?

Yes. Last release 30 Sep 2026, 40 releases in the last 24 months.

Who owns Login & Register Customizer, and has it changed hands?

No change recorded. Main committer xootix since Apr 2018.

Was Login & Register Customizer removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Login & Register Customizer safe?

12 known vulnerabilities, all fixed (latest in 3.2.5). Not on the exploited list.

Is the latest Login & Register Customizer update safe to install?

No ownership change before 4.0.4. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue