Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-02T07:16:37.883Z",
  "pubdate": "2026-09-02T07:16:37.883Z",
  "executiveSummary": "The Marcus Login With Ajax plugin is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user-supplied input during web page generation.\nThis vulnerability allows an unauthenticated attacker to inject malicious JavaScript into the web page viewed by a victim. When a user interacts with the crafted URL, the injected script executes within the context of their session.\nThe flaw impacts versions from n/a through 4.5.1. Successful exploitation can lead to session hijacking, unauthorized actions performed on behalf of the user, sensitive data exfiltration, and the redirection of users to malicious external domains.\nThe risk profile is high, as the exploit requires no authentication and can be triggered via a simple link, making it a viable vector for phishing and social engineering campaigns.",
  "technicalDetails": "The vulnerability resides in the way Login With Ajax processes input parameters when generating the HTML response. Specifically, the plugin fails to properly validate or sanitize user input before reflecting it directly into the application's response body.\nReflected XSS occurs when an application receives data in an HTTP request and includes that data within the immediate response in an unsafe way. In this instance, the plugin lacks adequate output encoding, allowing attackers to inject arbitrary HTML and JavaScript tags into the DOM.\nThe attack flow typically involves an attacker crafting a malicious URL containing a JavaScript payload embedded within a parameter handled by the plugin. The attacker then lures a victim into clicking the link, which forces the victim's browser to send the request to the vulnerable server.\nBecause the server includes the un-sanitized parameter in the generated HTML page, the victim's browser interprets the injected script as legitimate code originating from the trusted site. This bypasses security controls such as the Same-Origin Policy (SOP).\nThe payload executes in the context of the victim's session, allowing the attacker to access cookies, session tokens, or other sensitive information cached in the browser. Furthermore, the attacker can manipulate the Document Object Model (DOM) to modify page content, perform unauthorized actions through the victim’s logged-in status, or redirect the user to a malicious site.\nThis vulnerability affects versions n/a through 4.5.1. It is accessible over the network without requiring prior authentication or specific user privileges. The root cause is identified as the lack of context-aware output encoding, which is a fundamental requirement for preventing XSS in dynamic web applications."
}