Cross-site Scripting Flaw in Simple JWT Login by Nicu Micle
CVE-2025-58648

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Simple Jwt Login
Vendor
CVE Published:
22 September 2025

What is CVE-2025-58648?

A cross-site scripting vulnerability in the Simple JWT Login plugin for WordPress by Nicu Micle allows attackers to inject malicious scripts into web pages. This flaw may lead to the execution of harmful scripts in the context of affected users, compromising their session and potentially exposing sensitive information. The issue is present in all affected versions up to 3.6.4, highlighting the importance of timely updates and security measures.

Affected Version(s)

Simple JWT Login 0 <= 3.6.4

References

https://patchstack.com/database/Wordpress/Plugin/simple-j...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

theviper17 (Patchstack Alliance)
.