Improper neutralization of input during web page generation in the WordPress plugin ‘wordpress login form to anywhere’ by Ajay Sharma creates a stored cross‑site scripting flaw. Because user input is not properly escaped, an attacker can store malicious JavaScript that will be rendered when any visitor loads the login form page. The stored XSS could enable arbitrary script execution; based on common XSS effects it is inferred that an attacker might steal cookies, hijack sessions, or deface content.

The vulnerability is present in the WordPress plugin ‘wordpress login form to anywhere’ developed by Ajay Sharma. All released versions from the initial release (no specified version) through version 0.2 are affected.

With a CVSS score of 5.9 the flaw has moderate severity, and the EPSS score of less than 1 % and the absence from the CISA KEV catalog suggest that exploitation is currently rare. No privileged access is mentioned, so the likely attack vector is any user who can submit data to the plugin’s login form; the attacker would embed a malicious payload in the stored fields. If a site visitor loads the compromised page, the malicious script runs in the visitor’s browser context, potentially compromising confidentiality and integrity of sensitive data.