CVE-2026-10100 describes a stored cross-site scripting vulnerability in the Simple Custom Login Page WordPress plugin (up to version 1.0.3). The issue stems from insufficient input sanitization of color option fields (Page Background, Form Background, Text Color, Link Color) registered via register_setting() without a sanitize_callback. These values are output into a <style> block on wp-login.php using esc_attr(), which does not properly escape characters critical in CSS contexts, such as ;, {, }, /, or *. Consequently, authenticated users with administrator privileges can inject arbitrary CSS rules into the login page, which are rendered for all unauthenticated visitors. This can facilitate UI redress and credential phishing attacks. No known exploits in the wild have been reported, and no official fix or patch is documented at this time.

An authenticated attacker with administrator-level access can inject arbitrary CSS into the WordPress login page, affecting all unauthenticated visitors. This can lead to UI redress attacks and credential phishing by manipulating the login page appearance. The confidentiality and integrity impacts are low, as the vulnerability does not allow direct code execution or data theft, but it can mislead users and compromise login security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious changes to plugin settings. Avoid using the affected plugin version if possible or disable it temporarily to mitigate risk.