CVE-2026-10100: Stored XSS in Simple Custom Login Page WordPress Plugin – MEDIUM Severity

Technical summary

CVE-2026-10100 is a Stored Cross-Site Scripting (XSS) vulnerability in Simple Custom Login Page up to version 1.0.3. The vulnerability arises from two compounding weaknesses: first, the plugin registers color settings (Page Background, Form Background, Text Color, Link Color) without a sanitize_callback parameter in register_setting(), meaning user-supplied values bypass sanitization. Second, these unsanitized values are output into a <style> block using esc_attr(), which escapes HTML attribute metacharacters but not CSS metacharacters such as semicolons, braces, slashes, and asterisks. An authenticated administrator can exploit this by inserting payloads like `red; } body { background: url('...') }` to break the CSS context and inject arbitrary rules. Because the resulting page is served to all unauthenticated visitors, the malicious CSS executes in their browsers, enabling UI redress and credential harvesting.

Business impact

This vulnerability poses a direct threat to site user security and trust. While the attacker must hold administrator-level privileges, a compromised admin account—common in shared hosting environments or following lateral movement—grants access to manipulate the login experience for all site visitors. An attacker can visually disguise the legitimate login form, overlay a credential-stealing form, or redirect users to a phishing page, all without users detecting the manipulation. For WordPress sites hosting user accounts, this can result in mass credential compromise. Additionally, if the site is part of a larger ecosystem (e.g., multi-tenant hosting), a single compromised admin account can affect all visitors to that installation.

Affected systems

Simple Custom Login Page plugin versions up to and including 1.0.3 are affected. The vulnerability requires administrator-level access to exploit, so only WordPress installations with this plugin active are at risk. The attack vector is network-based and affects all unauthenticated visitors to the wp-login.php page once the malicious setting is saved.

Exploitability

Exploitation requires two conditions: an attacker must possess or compromise a WordPress administrator account, and the Simple Custom Login Page plugin must be installed and activated. The attack itself is trivial—no complex manipulation or race conditions are needed. Once settings are saved, the malicious CSS is automatically rendered to all login page visitors. However, this is not a zero-day or remotely exploitable vulnerability from an unauthenticated state. The barrier to exploitation is gaining admin access, not bypassing the plugin's code.

Remediation

Site operators should update the Simple Custom Login Page plugin to a patched version released after June 2026 (verify against the vendor advisory for the specific version). Administrators should review their active plugins and disable or remove this plugin if an update is not available. As an interim measure, restrict administrator account creation and implement strong credential policies to minimize the risk of admin account compromise. Consider using Web Application Firewall (WAF) rules to detect and block CSS injection patterns on login pages if the plugin cannot be immediately patched.

Patch guidance

Check the Simple Custom Login Page plugin repository or the vendor's website for an available security update released after the publication date of June 2, 2026. Apply the patch through the WordPress admin dashboard under Plugins > Updates. If no patch is available from the vendor, consider switching to an alternative login customization plugin with better input validation practices. Test the patched version in a staging environment before deploying to production to ensure compatibility with your site's theme and other plugins.

Detection guidance

Monitor WordPress administrator activity, particularly changes to plugin settings or option values related to login page styling. Check the wp_options table for color settings stored by this plugin and look for CSS metacharacters (semicolons, braces, slashes, asterisks) within those values. Review server logs and browser developer tools for suspicious CSS rules rendered on wp-login.php. Implement file integrity monitoring on the plugin directory to detect unauthorized modifications. Use security plugins that audit options table changes and alert on suspicious stored data patterns.

Why prioritize this

Although assigned a MEDIUM severity score (CVSS 4.4), this vulnerability warrants prompt attention because it directly enables phishing and credential theft targeting all site visitors. The low exploitability barrier (admin access required) is offset by the high business impact—compromised user credentials have cascading effects. Organizations running this plugin should prioritize patching or removal. Sites with strict admin access controls may lower the priority, but those with shared hosting or multiple admins should treat this as elevated risk.

Risk score, explained

The CVSS 3.1 score of 4.4 (MEDIUM) reflects the attack complexity: an attacker needs high-level privileges (PR:H) and the plugin must be active, but once exploited, the attack is consistent and affects all login page visitors (S:C, Scope Changed). Confidentiality and integrity are impacted (C:L, I:L) through credential theft and UI manipulation, but availability is not affected (A:N). The score does not account for the likelihood of admin compromise, only the severity of the attack if admin access is obtained.

Frequently asked questions