The vulnerability is a stored cross‑site scripting flaw that allows an attacker to inject malicious JavaScript into the login page configuration. Unsanitized user input is rendered directly when the page template is generated, providing a path for arbitrary code execution in the visitor’s browser. This can lead to session hijacking, credential theft or social‑engineering attacks targeted at site users.

All installations the WP Customize Login Page plugin by Carlo La Pera with a version of 1.6.5 or earlier are affected. Sites that have enabled the plugin and configured the login page via the WordPress administrative interface are exposed; the core WordPress software itself is not impacted.

The CVSS score of 5.9 reflects moderate severity, and the EPSS of less than 1 % indicates low current exploitation probability. The flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker who has permission to edit plugin settings can embed the payload, which will be served to every visitor of the modified login page, providing persistence and potential widespread impact.