Description

Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T15:16:58.763Z",
  "pubdate": "2026-08-18T15:16:58.763Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the Login With Ajax plugin, specifically affecting versions 4.5.1 and prior. This security flaw allows authenticated users with low-level privileges, specifically contributors, to inject malicious client-side scripts into web pages rendered by the application.\nThe primary impact of this vulnerability is the potential execution of arbitrary JavaScript within the context of another user's browser session, including high-privileged administrators. An attacker capable of exploiting this flaw could hijack administrative sessions, deface the website, redirect users to malicious external destinations, or perform unauthorized administrative actions on behalf of the victim.\nThe affected product is the Login With Ajax plugin for WordPress. The risk implication is significant as it bridges the gap between low-privileged internal users and high-impact session compromise. Successful exploitation requires an attacker to possess a contributor-level account on the target WordPress installation and relies on interacting with the vulnerable input handling mechanisms within the plugin.\nMitigation requires updating the Login With Ajax plugin beyond version 4.5.1 once a patched release is made available by the vendor, alongside strict enforcement of the Principle of Least Privilege regarding user roles.",
  "technicalDetails": "The vulnerability is classified as a Cross-Site Scripting (XSS) flaw residing within the input sanitization and output escaping routines of the Login With Ajax plugin, affecting versions 4.5.1 and below.\nThe root cause of the issue stems from insufficient input validation and a lack of proper contextual output encoding for data supplied by users possessing contributor privileges. When the application processes user-supplied input intended for storage or rendering, it fails to neutralize executable HTML and JavaScript payloads adequately.\nAttackers targeting this vulnerability must authenticate to the target WordPress instance with a contributor-level account, exposing an internal attack vector. The network exposure is web-based, requiring HTTP or HTTPS interaction with the vulnerable endpoint handling the plugin's functionalities.\nThe step-by-step attack flow begins with the authenticated contributor crafting a malicious payload containing arbitrary JavaScript enclosed within HTML tags or event handlers. The attacker submits this payload through input parameters processed by the vulnerable component of Login With Ajax. The application accepts the input and improperly sanitizes it before storing or reflecting it back within the application interface. When a higher-privileged user, such as an administrator, views the affected page containing the malicious payload, the browser executes the script within the DOM context of the victim's session.\nThe payload behavior includes executing unauthorized actions via the victim's authenticated session, such as creating rogue administrator accounts, modifying site configurations, or extracting sensitive session cookies and tokens. The post-exploitation impact ranges from complete site compromise to unauthorized privilege escalation within the content management system."
}