Stored Cross-Site Scripting in Admin Custom Login Plugin for WordPress

CVE-2026-2487

What is CVE-2026-2487?

The Admin Custom Login plugin for WordPress is prone to Stored Cross-Site Scripting attacks due to inadequate input sanitization and output escaping in admin settings. Authenticated attackers with administrator-level permissions can exploit this vulnerability to inject malicious scripts. When other users access affected pages, these scripts can execute, potentially leading to data theft or unauthorized actions. This issue is particularly relevant for multisite installations and environments where 'unfiltered_html' is disabled, increasing the risk for WordPress site administrators.

References