Is CVE-2026-10100 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10100 being exploited in the wild.

How severe is CVE-2026-10100?

Medium severity, with a CVSS score of 4.4, published 2 June 2026.

Which products and versions are affected?

Wordpress Simple Custom Login Page up to and including 1.0.3.

Is there a fix for CVE-2026-10100?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10100 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-10100?

Check whether you run Wordpress Simple Custom Login Page at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10100: WordPress Simple Custom Login Page Stored XSS in color settings

CVE-2026-10100 · Severity: medium · CVSS 4.4 · Published 2026-06-02

The Simple Custom Login Page plugin for WordPress, which allows site owners to customize the appearance of their login screens, contains a security flaw in its color settings. An attacker with administrative access can inject malicious code into these settings, which then runs when any visitor views the login page. This could be used to alter the login page's appearance to trick users into revealing their credentials or to perform other unauthorized actions.

Vendors: Wordpress.

Quick answers

Is CVE-2026-10100 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10100 being exploited in the wild.
How severe is CVE-2026-10100?: Medium severity, with a CVSS score of 4.4, published 2 June 2026.
Which products and versions are affected?: Wordpress Simple Custom Login Page up to and including 1.0.3.
Is there a fix for CVE-2026-10100?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10100 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-10100?: Check whether you run Wordpress Simple Custom Login Page at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Simple Custom Login Page plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization in the color settings fields (Page Background, Form Background, Text Color, and Link Color). The vulnerability exists because the plugin uses register_setting() without a sanitize_callback and subsequently outputs these values into a <style> block on wp-login.php using esc_attr() instead of proper CSS escaping. While esc_attr() handles HTML attributes, it fails to neutralize CSS-specific characters like semicolons and braces. An authenticated attacker with administrator-level privileges can exploit this to inject arbitrary CSS or break out of the style block to execute JavaScript. This can lead to UI redressing or credential phishing targeting unauthenticated visitors on the login page.

Affected products

WordPress Plugin Simple Custom Login Page up to and including 1.0.3

Timeline

2026-06-02: disclosed: Vulnerability published in NVD dataset

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.