WP Not Login Hide <= 1.0 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

PoC

1. Visit the “WPNLH” interface available in settings page of the plugin that is named “WPNLH Settings” 3. In the plugin’s “Warning Message” setting field, enter the payload Payload: " text"autofocus/onfocus=alert(1)// " 6. Click the “Save Changes” button. 7. The XSS will be triggered on the settings page when every visit of an authenticated user.