Admin Custom Login
Monthly
Stored Cross-Site Scripting in the Weblizar Admin Custom Login WordPress plugin (all versions ≤ 3.6.4) allows an authenticated administrator to inject persistent malicious scripts into the WordPress login page, which then execute in the browsers of any user who visits it - including unauthenticated visitors. The vulnerability is conditionally exploitable: it only manifests on WordPress multi-site networks or single-site installations where the unfiltered_html capability has been explicitly revoked from administrators, both non-default configurations. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the ~/includes/Login-form-setting/Login-form-background.php file which. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored Cross-Site Scripting in the Weblizar Admin Custom Login WordPress plugin (all versions ≤ 3.6.4) allows an authenticated administrator to inject persistent malicious scripts into the WordPress login page, which then execute in the browsers of any user who visits it - including unauthenticated visitors. The vulnerability is conditionally exploitable: it only manifests on WordPress multi-site networks or single-site installations where the unfiltered_html capability has been explicitly revoked from administrators, both non-default configurations. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the ~/includes/Login-form-setting/Login-form-background.php file which. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.