The Login‑Logout plugin contains an improper neutralization of input during web page generation that allows attackers to inject and persist malicious scripts within the plugin’s interface. These scripts can run in the browsers of users who visit pages that include the vulnerable plugin output, potentially enabling the execution of arbitrary code in the context of the site. The weakness is identified as CWE‑79, indicating a stored cross‑site scripting flaw.

WordPress sites that use the webvitaly Login‑Logout plugin version 3.8 or earlier are affected. Any installation of the plugin not at a later version is potentially vulnerable.

The CVSS score of 5.9 places this vulnerability in the medium severity range, while an EPSS score of less than 1% indicates that exploitation is unlikely but not impossible. The flaw is not listed in the CISA KEV catalog. Exploitation would require an attacker or a compromised user to submit input that the plugin stores and later emits in page output, so the attack vector is limited to environments where the attacker can provide input through the plugin’s interface.