Login With Ajax CVE-2026-82883

The Login With Ajax plugin (version ≤ 4.5.1) must be installed and active on the target WordPress site. Exploitation requires the victim to interact with a crafted URL (UI:R), making social engineering a prerequisite - the attacker cannot trigger execution purely server-side. No attacker authentication is required (PR:N). The vulnerability appears to affect the plugin's default-installed state with no non-default configuration needed on the server side. Exploitation is limited by: (1) the victim must click a malicious link, (2) JavaScript must be enabled in the victim's browser, and (3) the WordPress installation must have the plugin active. No special server-side configuration or authenticated access is required from the attacker's perspective.

The CVSS 7.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) is consistent with a standard reflected XSS pattern: network-reachable, low complexity, no attacker authentication required, but dependent on victim interaction (UI:R). The UI:R requirement is the primary mitigating factor - exploitation demands social engineering to lure a target to a crafted URL. No EPSS score was provided in the input data, and this CVE does not appear on the CISA KEV catalog, placing it outside confirmed active exploitation. No public proof-of-concept was identified. The A:L metric (availability impact) in the submitted vector is questionable for a reflected XSS, which typically does not independently affect availability; this is flagged in the assessed CVSS below. Real-world risk is moderate: WordPress sites are high-value targets, and any authenticated user (including admins) tricked into clicking the URL could have their session hijacked.

An attacker crafts a URL pointing to a WordPress site running Login With Ajax, embedding a JavaScript payload in a vulnerable query parameter (e.g., a redirect or error message parameter). The attacker distributes this link via phishing email or social media targeting site visitors or administrators. When a victim clicks the link, the plugin reflects the unencoded payload in the response page and the script executes in the victim's browser, potentially stealing their WordPress session cookie or performing actions on their behalf.