The login_register plugin for WordPress contains missing nonce validation on its settings page together with insufficient sanitization and escaping of the login_register_login_post input. This flaw enables a Cross‑Site Request Forgery that can store arbitrary JavaScript in the site’s configuration. An attacker can craft a request that, when an administrator clicks a malicious link, writes malicious code into the plugin’s settings. The code is then served to any visitor who accesses the affected page, allowing defacement, cookie theft, or other client‑side compromise.

WordPress installations that have the frankkoenen login_register plugin with a version of 1.2.0 or earlier running are affected. The vulnerability is triggered when the insecure settings page is accessed, so sites that have enabled the plugin’s settings editing must be considered vulnerable.

The CVSS score of 4.3 indicates moderate severity. Exploitation requires no prior authentication and only a simple social‑engineering step – persuading an administrator to click a forged link. Because the vulnerability is not listed in the KEV catalog and EPSS data are unavailable, the probability of exploitation is uncertain, but the potential impact on all visitors to the compromised page remains significant for systems lacking robust admin awareness training.