CVE-2023-5940

CVE-2023-5940 affects the WP Not Login Hide (WPNLH) WordPress plugin up to version 1.0. The issue is stored XSS in the plugin settings: an admin (high privilege) could inject payloads via the WPNLH Settings warning message field, potentially triggering stored XSS for authenticated users (includin...

WP Not Login Hide <= 1.0 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Visit the "WPNLH" interface availab...