This vulnerability involves improper neutralization of user input when generating web pages in the Lime Developer Login plugin. An attacker can send crafted requests that contain JavaScript code, which the plugin reflects back in the browser without proper escaping, leading to a Broken XSS flaw (CWE‑79). Infected pages would execute attacker‑supplied scripts in the context of a site visitor, potentially enabling session hijacking, credential theft, or defacement.

WordPress sites running the Lima Developer Login plugin, version 1.4.0 or earlier, published by limesquare.

The CVSS score of 7.1 indicates a high severity for cross‑site scripting. The EPSS score is less than 1%, suggesting that widespread exploitation is unlikely, and the vulnerability is not listed in the CISA KEV catalog. However, the simplest attack path is an unauthenticated web request containing malicious data in a GET parameter, which is reflected in the page output. Given that the flaw is input‑based and the application uses a publicly reachable endpoint, execution can be achieved from remote traffic without the need for additional pre‑conditions.