Login Watchdog plugin for WordPress contains an input sanitization flaw that allows stored cross‑site scripting. An attacker who can submit data to the plugin can embed a malicious script that is later served to any user who views the affected page. If the victim is logged in, the attacker may hijack the session, steal cookies, or perform other malicious actions within the context of the authenticated user. The vulnerability qualifies as a high‑severity cross‑site scripting flaw (CVSS 7.1).

The issue affects the JkmAS Login Watchdog plugin, versions up to and including 1.0.4. Any WordPress installation that has Login Watchdog 1.0.4 or earlier installed is vulnerable.

The CVSS base score of 7.1 indicates a major impact when exploited. The EPSS score is below 1%, meaning current exploitation likelihood is low, yet the presence of stored XSS provides a persistent attack vector that can affect all users browsing the site. The vulnerability is not yet enumerated in the CISA KEV catalog. Attackers typically gain control by submitting malicious input through administrative interfaces or user‑reporting forms within the plugin, a scenario inferred from typical plugin behavior, although the CVE description does not explicitly specify the exact vector.