The vulnerability is a stored Cross‑Site Scripting flaw that allows an attacker to inject arbitrary JavaScript into pages rendered by the WordPress site. The injected payload executes in the context of any user who views the affected page, potentially giving the attacker the ability to exfiltrate session cookies, steal credentials, or perform actions on behalf of the user. This does not provide direct remote code execution on the server but can enable phishing or credential theft attacks.

The flaw exists in the Simple JWT Login plugin developed by Nicu Micle. All versions up to and including 3.6.4 are susceptible. No additional version information is provided beyond this upper bound.

The CVSS score of 6.5 indicates a moderate severity impact. The low EPSS score of less than 1% implies that exploitation is currently unlikely to be widespread or automated. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to supply malicious input—likely through the login or plugin configuration interfaces. This requirement is inferred from the stored nature of the XSS. Once stored, any visitor to the affected page would be impacted. Because the flaw appears not to require elevated privileges—a conclusion inferred from its stored nature—it can affect all site users, and mitigations should focus on validating and sanitizing input before storage.