CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-page allows Stored XSS.This issue affects WP Customize Login Page: from n/a through <= 1.6.5.
Explanation of Vulnerability in Simple Terms
WP Customize Login Page versions up to 1.6.5 contain a stored cross-site scripting (XSS) vulnerability. An authenticated administrator can inject malicious scripts into login page customization settings. When other users or administrators view the login page, the injected code executes in their browsers, potentially compromising their sessions or stealing credentials.
What an attacker can do
Inject malicious scripts that execute when users view the login page, potentially stealing credentials or hijacking sessions.
Potential impact on your site
An admin account compromise could allow an attacker to deface your login page or steal visitor credentials without additional technical barriers.
Conditions required to exploit
Attacker must have administrator privileges and the victim must visit the affected login page.
Key dates
External resources
