Description

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-08-16T04:16:27.943Z",
  "pubdate": "2026-08-16T04:16:27.943Z",
  "executiveSummary": "The Admin Custom Login plugin for WordPress suffers from a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to, and including, 3.6.4.\nThis security flaw arises due to insufficient input sanitization and output escaping mechanisms implemented within the administrative settings of the application.\nThe vulnerability allows authenticated attackers possessing administrator-level permissions or higher to inject arbitrary web scripts and malicious payloads into administrative pages.\nThe injected script executes within the context of a victim's browser session whenever any user accesses the compromised page, introducing severe risk implications such as session hijacking, administrative privilege escalation, or unauthorized modifications.\nExploitation of this vulnerability is specifically limited to WordPress multi-site installations or environments where the unfiltered_html capability has been explicitly disabled for administrators.\nDespite the requirement for high-level privileges, the risk remains significant in multi-site configurations where administrative boundaries between sub-sites must be strictly maintained to prevent cross-site compromise.",
  "technicalDetails": "The root cause of this Stored Cross-Site Scripting vulnerability stems from the application's failure to properly sanitize user-supplied input submitted via the plugin's admin settings and its subsequent failure to adequately escape that data upon output to the Document Object Model (DOM).\nThe vulnerable component resides within the admin settings management interface of the Admin Custom Login plugin, affecting all software versions up to and including 3.6.4.\nAuthentication and privilege requirements dictate that an attacker must successfully authenticate to the WordPress dashboard with administrator-level permissions or higher to interact with the vulnerable settings interface.\nThe attack flow proceeds as follows: First, the authenticated attacker navigates to the Admin Custom Login settings page within the WordPress dashboard. Second, the attacker inputs a crafted payload containing malicious JavaScript into one of the configurable admin settings fields. Third, the application processes the request and persists the malicious payload directly into the database without applying appropriate sanitization functions. Fourth, when any user subsequently accesses the injected administrative page, the server retrieves the unescaped payload from the database and renders it directly into the response HTML. Finally, the victim's browser parses and executes the arbitrary web script within the security context of their active session.\nBecause the payload executes in the browser of users accessing the injected page, the post-exploitation impact includes the potential execution of unauthorized actions, theft of sensitive session cookies, and further compromise of the affected WordPress environment depending on the victim's privilege level."
}