The vulnerability is an unauthenticated Cross Site Scripting (XSS) flaw in the WordPress WPS Limit Login plugin versions 1.5.9.3 and earlier. An attacker who sends a crafted request to the plugin can inject arbitrary JavaScript that executes in the context of any user who views the affected page. While the description does not detail specific consequences, based on typical XSS behavior it could allow theft of session cookies, credential hijacking, or other malicious actions performed in the victim’s browser.

The affected product is the WordPress WPS Limit Login plugin, developed by NicolasKulka. Versions 1.5.9.3 and earlier are impacted. The plugin runs on WordPress installations, so any site that has a vulnerable version installed is at risk; no further version information is provided beyond the <= 1.5.9.3 bound.

The CVSS score is 7.1, indicating a high severity vulnerability. EPSS score is not available and the vulnerability is not listed in CISA KEV. The flaw requires web access and is unauthenticated, meaning any visitor to a vulnerable site could potentially inject malicious script. This could compromise user sessions or facilitate the spread of malware through the affected site.