Executive brief
The Simple Custom Login Page plugin for WordPress, which allows site owners to customize the appearance of their login screens, contains a security flaw in its color settings. An attacker with administrative access can inject malicious code into these settings, which then runs when any visitor views the login page. This could be used to alter the login page's appearance to trick users into revealing their credentials or to perform other unauthorized actions.
Technical details
The Simple Custom Login Page plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization in the color settings fields (Page Background, Form Background, Text Color, and Link Color). The vulnerability exists because the plugin uses register_setting() without a sanitize_callback and subsequently outputs these values into a <style> block on wp-login.php using esc_attr() instead of proper CSS escaping. While esc_attr() handles HTML attributes, it fails to neutralize CSS-specific characters like semicolons and braces. An authenticated attacker with administrator-level privileges can exploit this to inject arbitrary CSS or break out of the style block to execute JavaScript. This can lead to UI redressing or credential phishing targeting unauthenticated visitors on the login page.
Affected products
- WordPress Plugin Simple Custom Login Page up to and including 1.0.3
Timeline
- 2026-06-02: disclosed: Vulnerability published in NVD dataset
References
- https://plugins.trac.wordpress.org/browser/simple-custom-login-page/tags/1.0.3/admin/class-simple-custom-login-page-admin.php
- https://plugins.trac.wordpress.org/browser/simple-custom-login-page/tags/1.0.3/includes/class-simple-custom-login-page.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/96d03984-623a-44c7-a46f-e1aabbc566d5?source=cve