Description
The Login with Cognito WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Login with Cognito | ≤ 1.4.8 | — |
Advisories 1
- WID-SEC-2023-1350 Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von Drittanbietern BSI CERT-Bund (WID) · Jul 1, 2026
References
- https://wpscan.com/vulnerability/ac2e3fea-e1e6-4d90-9945-d8434a00a3cf exploit vdb-entry technical-description