Stored Cross-Site Scripting in Simple Custom Login Page Plugin for WordPress

CVE-2026-10100

What is CVE-2026-10100?

The Simple Custom Login Page plugin for WordPress is susceptible to stored cross-site scripting (XSS) attacks due to insufficient input sanitization. Specifically, the vulnerability arises from the color settings fields, including options like Page Background, Form Background, Text Color, and Link Color, in versions up to and including 1.0.3. The registered values are not properly sanitized, allowing authenticated users with administrator-level access to inject arbitrary CSS rules into the login page. This malicious content is then rendered for all unauthenticated visitors, potentially leading to UI redirection and credential-phishing attacks.

References