CVE-2026-10100 is a stored cross-site scripting vulnerability in the Simple Custom Login Page WordPress plugin (up to version 1.0.3). The issue arises from insufficient input sanitization of color setting fields (Page Background, Form Background, Text Color, Link Color) that are registered and stored without a sanitize callback. These values are then output into a <style> block on wp-login.php using esc_attr(), which does not properly escape characters relevant in CSS context, allowing injection of arbitrary CSS rules. Exploitation requires authenticated administrator-level access and can affect all unauthenticated visitors by altering the login page's appearance, facilitating UI redress and credential phishing.

An attacker with administrator privileges can inject arbitrary CSS into the login page, which is rendered for all unauthenticated visitors. This can lead to UI redress attacks and credential phishing by manipulating the login interface. The vulnerability does not directly allow code execution or data theft but can be leveraged to deceive users and capture credentials. The CVSS score of 4.4 reflects a medium severity impact with low confidentiality and integrity impact and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should restrict access to trusted users only and consider disabling or replacing the plugin to prevent exploitation. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming official patches.