PT-2025-10949 · WordPress · Ajay Sharma Wordpress Login Form To Anywhere

Nabil Irawan · Published 2025-03-11 · Updated 2025-03-12 · CVE-2025-28914

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Ajay Sharma wordpress login form to anywhere versions n/a through 0.2

Description: The issue is related to improper neutralization of input during web page generation, which allows for Cross-site Scripting (XSS). Specifically, it enables Stored XSS. This problem affects the WordPress login form.

Recommendations: For versions n/a through 0.2, consider disabling the login form functionality until a patch is available to prevent exploitation. Restrict access to the login form to minimize the risk of Stored XSS attacks. Avoid using the vulnerable login form until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-28914

Affected Products

Ajay Sharma Wordpress Login Form To Anywhere

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-28914 · Security Note
• https://patchstack.com/database/wordpress/plugin/wp-show-login-form/vulnerability/wordpress-wordpress-login-form-to-anywhere-plugin-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1899713919939231814 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/wp-show-login-form/vulnerability/wordpress-wordpress-login-form-to-anywhere-plugin-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve · Note