Cross-site Scripting Vulnerability in Login With Ajax by Marcus
CVE-2026-82883

7.1HIGH

Key Information:

Vendor

WordPress
Status
Login With Ajax
Vendor
CVE Published:
2 September 2026

What is CVE-2026-82883?

A Cross-site Scripting (XSS) vulnerability exists in the Login With Ajax plugin developed by Marcus, allowing attackers to inject malicious scripts into web pages. This issue stems from improper input neutralization during web page generation, creating opportunities for reflected XSS attacks. Affected versions include Login With Ajax from 'n/a' to 4.5.1, posing a significant risk to users who have not updated their plugins. It is imperative for WordPress users to address this vulnerability by applying the latest updates to protect their applications.

Affected Version(s)

Login With Ajax <= 4.5.1

References

https://patchstack.com/database/wordpress/plugin/login-wi...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adam Kahlon (Adkali) | Patchstack Bug Bounty Program
.