The User Login History plugin does not properly neutralize input before rendering it on the login history page, allowing attackers to store malicious scripts that are executed whenever a visitor loads the page. This flaw enables a stored XSS condition that can affect any user who views the compromised page.

The vulnerability exists in the WordPress plugin User Login History developed by Faiyaz Alam. All versions from the initial release through version 2.1.6 are affected. Any WordPress site that has this plugin installed and has not upgraded beyond 2.1.6 is vulnerable.

The CVSS base score of 6.5 indicates a medium severity impact. The EPSS score is below 1 %, implying a low probability of active exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply malicious input that the plugin stores and later displays, typically through an authenticated user interface, to trigger the stored XSS when a visitor loads the login history page.