The Simple Custom Login Page plugin fails to properly sanitize color option values in its settings page, allowing an authenticated user with administrator privileges to inject custom CSS into a <style> tag on wp‑login.php. The injected styles are rendered for all visitors to the login page, enabling attackers to perform UI‑redress and credential‑phishing attacks. The flaw is a classic Stored Cross‑Site Scripting vulnerability (CWE‑79).

WordPress sites running the Simple Custom Login Page plugin version 1.0.3 or earlier. The vulnerability impacts only sites that have the plugin installed and where an attacker can log in as an administrator or higher. Non‑WordPress sites or newer plugin releases are not affected.

The CVSS score of 4.4 indicates a medium severity. Since the exploit requires administrative access and there are no publicly available exploit tools, the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated remote path whereby an attacker with admin privileges injects malicious CSS via the plugin settings. Once injected, the malicious CSS affects all unauthenticated users who view the login page, potentially leading to credential theft. The moderate CVSS score suggests a moderate risk if an attacker gains admin access, but the lack of public exploitation reduces immediate threats.