This vulnerability in the Better WP Login Page plugin (<= 1.1.2) allows stored cross-site scripting due to improper input neutralization during web page generation. An attacker with high privileges and requiring user interaction could inject malicious scripts that impact confidentiality, integrity, and availability to a limited extent. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, and user interaction needed, with a scope change and partial impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with high privileges to inject and store malicious scripts that execute in the context of users visiting the affected pages. This may lead to partial compromise of confidentiality, integrity, and availability of the affected system. However, exploitation requires user interaction and high privileges, limiting the ease of attack. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin settings to trusted administrators only and monitor for suspicious activity related to the login page. Avoid exposing the affected plugin to untrusted users. Follow up with the vendor for updates on patches or official mitigations.