The Login Manager – Design Login Page, View Login Activity, Limit Login Attempts plugin for WordPress is vulnerable to stored cross‑site scripting via custom logo and background URLs in all versions up to and including 2.0.5. The flaw originates from insufficient input sanitization and output escaping, enabling authenticated attackers with administrator-level access to inject arbitrary JavaScript that will execute whenever a user views a page containing the injected data.

WordPress installations using the Login Manager – Design Login Page, View Login Activity, Limit Login Attempts plugin, versions 2.0.5 and earlier, on multisite setups where the unfiltered_html role is disabled.

The CVSS score of 4.4 indicates moderate severity, and the EPSS score of less than 1 percent suggests low likelihood of exploitation at present. Because the vulnerability requires an authenticated administrator and affects only multisite environments with unfiltered_html disabled, the overall risk is limited, though still significant for sites that rely heavily on that plugin.