This vulnerability (CWE-79) in the Vinod Dalvi Login Logout Register Menu plugin allows stored cross-site scripting due to improper input neutralization during web page generation. It affects all versions up to 2.0. The CVSS 3.1 score of 6.5 reflects that an attacker with low privileges and requiring user interaction can cause a partial impact on confidentiality, integrity, and availability. No patch or official fix is currently documented, and the vendor has not provided remediation details.

An attacker with limited privileges can inject malicious scripts that are stored and executed in the context of other users' browsers, potentially leading to session hijacking, data theft, or other malicious actions impacting confidentiality, integrity, and availability to a limited extent. The vulnerability requires user interaction and privileges to exploit. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting user input where possible and applying web application firewall (WAF) rules to detect and block XSS payloads related to this plugin. Monitor vendor channels for updates and patches.