CVE-2025-2613

Vulnerability

The Login Manager – Design Login Page, View Login Activity, Limit Login Attempts plugin for WordPress versions up to and including 2.0.5 suffers from a stored cross-site scripting (XSS) vulnerability. The plugin fails to properly sanitize custom logo and background URLs, allowing injection of arbitrary web scripts. This vulnerability affects only multi-site installations or installations where the unfiltered_html capability has been disabled. The issue resides in the handling of these URLs, as seen in reference [1].

Exploitation

An authenticated attacker with administrator-level permissions can inject malicious scripts via custom logo or background URL fields. The attacker must have the ability to access the plugin settings page. The script will be stored and executed whenever any user (including lower-privilege users) accesses a page that displays the injected content, such as the login page. No user interaction is required beyond normal page load.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The attack is persistent and affects all users who view the manipulated login page.

Mitigation

No official patch has been released as of the publication date (2025-04-18). Users should consider disabling the plugin or restricting access to the plugin settings to only trusted administrators. As a workaround, ensure that unfiltered_html capability is enabled for all administrators on multisite installations if possible. The vendor may release a fix in a future version.