The Pit Login Welcome plugin encodes user input improperly during web page generation, allowing an attacker to inject malicious scripts into reflected responses. This CWE-79 vulnerability can execute code in the browser of any user who follows a crafted link, potentially leading to credential theft, session hijacking, or defacement. Because the payload is not sanitized before rendering, the attack does not require elevated privileges on the server.

The vulnerability affects Pantho Bihosh Pit Login Welcome versions from the initial release up through 1.1.5 inclusive. Users running any of these versions with the plugin enabled are susceptible.

With a CVSS score of 7.1 the vulnerability is considered moderate to high risk, yet its EPSS score of less than 1% indicates that exploitation is currently unlikely. The issue is not yet listed in CISA KEV. The attack vector is a standard reflected XSS scenario: an attacker supplies a malicious query string, and a victim who clicks the resulting link is presented with a page that injects the attacker's script. No advanced privileges or credentials are required for exploitation.