CVE-2021-24214

WordPress OpenID Connect Generic Client plugin 3.8.0–3.8.1 contains a reflected XSS via the login error handling (no authentication required; triggers with default config). The issue is caused by insufficient sanitization of login errors when echoed on the login form. Exploitation details are sho...