The Hide Login+ plugin contains an improper neutralization of user input that allows an attacker to inject arbitrary JavaScript into pages that display user‑supplied query data. This flaw is a reflected cross‑site scripting vulnerability classified as CWE‑79 and is present in all releases of the plugin up to and including version 3.5.1.

WordPress installations that have the Hide Login+ plugin version 3.5.1 or earlier deployed are affected. The issue does not distinguish between specific WordPress core versions, so any site running a vulnerable plugin instance is at risk.

The CVSS score of 7.1 indicates moderate‑to‑high severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not in CISA’s KEV catalog. Based on the description, the likely attack vector involves an attacker crafting a URL that contains malicious input and directing a user to that link. No privileged access or special tools are required for exploitation; the attack succeeds when a victim’s browser processes the crafted request.