{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-2613", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-21T16:37:31.081Z", "datePublished": "2025-04-18T01:44:10.917Z", "dateUpdated": "2026-04-08T17:25:27.112Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:25:27.112Z"}, "affected": [{"vendor": "mehrazmorshed", "product": "Login Manager \u2013 Design Login Page, View Login Activity, Limit Login Attempts", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Login Manager \u2013 Design Login Page, View Login Activity, Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom logo and background URLs in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "Login Manager \u2013 Design Login Page, View Login Activity, Limit Login Attempts <= 2.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom URL", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d2ea5e34-9303-43c8-8579-80ef02e1d9c4?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/customized-login/trunk/customized-login.php#L199"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Arshid KV"}], "timeline": [{"time": "2025-01-06T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-04-17T12:41:19.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-18T11:39:34.297127Z", "id": "CVE-2025-2613", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-18T12:01:23.964Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2613", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-18T11:39:34.297127Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-18T11:39:40.621Z"}}], "cna": {"title": "Login Manager \u2013 Design Login Page, View Login Activity, Limit Login Attempts <= 2.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom URL", "credits": [{"lang": "en", "type": "finder", "value": "Arshid KV"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "mehrazmorshed", "product": "Login Manager \u2013 Design Login Page, View Login Activity, Limit Login Attempts", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.0.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-01-06T00:00:00.000+00:00", "value": "Discovered"}, {"lang": "en", "time": "2025-04-17T12:41:19.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d2ea5e34-9303-43c8-8579-80ef02e1d9c4?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/customized-login/trunk/customized-login.php#L199"}], "descriptions": [{"lang": "en", "value": "The Login Manager \u2013 Design Login Page, View Login Activity, Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom logo and background URLs in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-04-18T01:44:10.917Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2613", "state": "PUBLISHED", "dateUpdated": "2025-04-18T12:01:23.964Z", "dateReserved": "2025-03-21T16:37:31.081Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-04-18T01:44:10.917Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Login Manager \u2013 Design Login Page, View Login Activity, Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom logo and background URLs in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}, {"lang": "es", "value": "El complemento Login Manager \u2013 Design Login Page, View Login Activity, Limit Login Attempts para WordPress es vulnerable a Cross Site Scripting almacenado mediante URL personalizadas de logotipos y fondos en todas las versiones hasta la 2.0.5 incluida, debido a una depuraci\u00f3n de entrada y al escape de salida insuficiente. Esto permite a atacantes autenticados, con permisos de administrador o superiores, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada. Esto solo afecta a instalaciones multisitio y a instalaciones donde se ha deshabilitado unfiltered_html."}], "id": "CVE-2025-2613", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-04-18T02:15:14.250", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/customized-login/trunk/customized-login.php#L199"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d2ea5e34-9303-43c8-8579-80ef02e1d9c4?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T23:14:36.316381+00:00", "value": {"mitigation_remediation": ["Upgrade the plugin to a version newer than 2.0.5 if one is available.", "Remove or sanitize existing logo and background URLs, limiting them to trusted HTTPS links or disabling the custom URL fields entirely.", "Revoke the unfiltered_html capability from all users to prevent arbitrary HTML or JavaScript injection."], "summary": {"action": "Update Plugin", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress installations using the Login Manager \u2013 Design Login Page, View Login Activity, Limit Login Attempts plugin, versions 2.0.5 and earlier, on multisite setups where the unfiltered_html role is disabled.", "description_and_impact": "The Login Manager \u2013 Design Login Page, View Login Activity, Limit Login Attempts plugin for WordPress is vulnerable to stored cross\u2011site scripting via custom logo and background URLs in all versions up to and including 2.0.5. The flaw originates from insufficient input sanitization and output escaping, enabling authenticated attackers with administrator-level access to inject arbitrary JavaScript that will execute whenever a user views a page containing the injected data.", "risk_and_exploitability": "The CVSS score of 4.4 indicates moderate severity, and the EPSS score of less than 1 percent suggests low likelihood of exploitation at present. Because the vulnerability requires an authenticated administrator and affects only multisite environments with unfiltered_html disabled, the overall risk is limited, though still significant for sites that rely heavily on that plugin."}}}}, "created": "2026-04-20T23:15:06.312135+00:00", "updated": "2026-04-20T23:15:06.312147+00:00", "vendors": []}