Stored Cross-Site Scripting Vulnerability in Login Manager Plugin for WordPress

CVE-2025-2613

What is CVE-2025-2613?

The Login Manager – Design Login Page, View Login Activity, Limit Login Attempts plugin for WordPress contains a vulnerability that allows authenticated users with administrator-level permissions to exploit insufficient input sanitization and output escaping. This vulnerability is specifically triggered through the custom logo and background URL settings, enabling the injection of arbitrary scripts. Affected installations with multi-site configurations or where unfiltered HTML is not allowed are particularly at risk, as attackers can execute these scripts whenever a user accesses an exploited page.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References