CVE-2026-10100

An authenticated attacker with administrator privileges can inject arbitrary CSS rules by providing malicious input into the color settings fields, such as Page Background, Form Background, Text Color, or Link Color. These settings are registered using `register_setting()` without a `sanitize_callback` and stored via the Settings API. The values are then output into a `<style>` block on `wp-login.php` using `esc_attr()`, which does not escape characters critical for CSS, such as ';', '{', '}', '/', or '*'. This allows the injection of CSS that is rendered for all unauthenticated visitors.

The vulnerability lies within the `Simple_Custom_Login_Page` class, specifically in the `simple_custom_login_page_customize()` method where options like `simple_custom_login_page_background`, `simple_custom_login_page_text_color`, `simple_custom_login_page_form_bg`, and `simple_custom_login_page_link_color` are retrieved using `get_option()` and output. The settings are registered in `Simple_Custom_Login_Page_Admin` class's `simple_custom_login_page_settings()` method without a `sanitize_callback`.

The patch is not provided in the bundle. The advisory indicates that the vulnerability is due to insufficient input sanitization of color option values. Remediation guidance would typically involve implementing proper sanitization for these values before they are stored and output, ensuring that only valid CSS color values are accepted and that potentially harmful characters are escaped or removed.