CVE-2026-2487: Admin Custom Login <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Setting
The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfilteredhtml has been disabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/plugins/admin-custom-loginto a version that resolves this vulnerability.Fixed in 3.6.4 - Configuration
This issue only affects installations where 'unfiltered_html has been disabled'; consider enabling unfiltered_html or otherwise ensure admin settings displayed in the login form (e.g., 'Message Above Login Form') are properly sanitized/escaped by applying the plugin update and/or sanitization controls.
WordPress unfiltered_html = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2487?
The severity of CVE-2026-2487 is medium with a score of 4.4.
How do I fix CVE-2026-2487?
To fix CVE-2026-2487, update the Admin Custom Login plugin to the latest version beyond 3.6.4.
What type of vulnerability is CVE-2026-2487?
CVE-2026-2487 is a Stored Cross-Site Scripting (XSS) vulnerability.
Who can exploit CVE-2026-2487?
CVE-2026-2487 can be exploited by authenticated attackers with administrator-level permissions.
What impact does CVE-2026-2487 have on affected systems?
CVE-2026-2487 allows attackers to inject malicious scripts, which could compromise the security of affected WordPress installations.