What is the CVSS score of CVE-2026-10100?

CVE-2026-10100 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Simple Custom Login Page CVE-2026-10100

EUVD-2026-33870 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-02 Wordfence

GHSA-855q-xm3j-j7h8

XSS PHP WordPress

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 02:45 vuln.today

CVE Published

Jun 02, 2026 - 01:28 nvd

MEDIUM 4.4

DescriptionCVE.org

The Simple Custom Login Page plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the color settings fields (Page Background, Form Background, Text Color, Link Color) in versions up to and including 1.0.3. This is due to insufficient input sanitization of the color option values (they were registered with register_setting() and stored via the Settings API/update_option() with no sanitize_callback) combined with the values being output into a <style> block on wp-login.php using esc_attr(), which is incorrect for a CSS context (it does not escape ;, {, }, / or *). This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary CSS rules into the login page that are rendered for all unauthenticated visitors, enabling UI-redress and credential-phishing attacks.

Articles & Coverage 1

medium.com CVE-2026-10100: Stored XSS in Simple Custom Login Page WordPress Plugin Jul 06, 2026

AnalysisAI

Stored Cross-Site Scripting in the Simple Custom Login Page WordPress plugin (versions ≤ 1.0.3) allows authenticated administrators to inject arbitrary CSS rules into wp-login.php, which is then rendered for every unauthenticated visitor to the login page. The changed scope (S:C in CVSS) is the critical risk amplifier: a single administrator-level compromise or malicious admin can silently overlay phishing UI elements on the WordPress login page, harvesting credentials from any user who subsequently visits. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The affected plugin (CPE: cpe:2.3:a:pattihis:simple_custom_login_page:*:*:*:*:*:*:*:*) registers color customization options - Page Background, Form Background, Text Color, Link Color - via WordPress's register_setting() API without supplying a sanitize_callback parameter, meaning no server-side validation or sanitization occurs on save (as visible in admin/class-simple-custom-login-page-admin.php#L206). The stored values are later echoed into a raw CSS <style> block on wp-login.php using esc_attr() (class-simple-custom-login-page.php#L248). CWE-79 (Improper Neutralization of Input During Web Page Generation) applies here with a context mismatch at its core: esc_attr() correctly encodes HTML attribute special characters but does not escape CSS control characters such as semicolons, braces, forward slashes, or asterisks. This allows an attacker to break out of the intended CSS property value and insert arbitrary CSS rules - including rules that reposition elements, inject content via CSS url() or counter() tricks, or overlay invisible phishing forms.

RemediationAI

No vendor-released patched version has been identified at time of analysis - affected versions run up to and including 1.0.3 with no confirmed successor release noted in the references. Until an update is available, the primary compensating control is to deactivate or uninstall the Simple Custom Login Page plugin, eliminating the vulnerable code path entirely; this removes login page customization but closes the injection vector. If the plugin must remain active, strictly auditing and limiting WordPress administrator accounts reduces the pool of principals who could exploit this - enforce MFA on all admin accounts and review admin user lists for unauthorized entries. Monitor the Wordfence advisory page and the WordPress plugin repository for a patched release. Avoid relying on WAF rules alone, as CSS context injection is difficult to fingerprint reliably without breaking legitimate color value inputs.