CVE-2026-1503 describes a vulnerability in the frankkoenen login_register WordPress plugin (versions up to 1.2.0) where missing nonce validation on the settings page combined with insufficient input sanitization and output escaping of the 'login_register_login_post' parameter enables Cross-Site Request Forgery leading to Stored Cross-Site Scripting. This allows unauthenticated attackers to inject malicious scripts that execute in the context of an administrator's browser when they interact with a crafted request.

The vulnerability allows an attacker to perform CSRF attacks that result in stored XSS, potentially enabling script execution in an administrator's session. This can lead to unauthorized actions performed with administrator privileges or session hijacking. However, the CVSS score of 4.3 indicates a medium severity with limited impact on confidentiality and no impact on availability or integrity directly.

No official patch or fix is currently available for this vulnerability. Users of the login_register plugin should monitor the vendor's advisory for updates. Until a fix is released, administrators should avoid interacting with untrusted links or requests that could trigger the vulnerability. Implementing manual nonce validation and input sanitization could be considered as a temporary mitigation if feasible.