CVE-2026-93622 describes an unauthenticated Cross Site Scripting (XSS) vulnerability affecting WPS Limit Login plugin versions up to 1.5.9.3. The vulnerability allows remote attackers to inject and execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, information disclosure, or other impacts. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to partial confidentiality, integrity, and availability impacts, such as theft of user credentials, session tokens, or execution of unauthorized actions in the context of the victim user. Since the vulnerability is unauthenticated, any remote attacker can attempt exploitation. However, user interaction is required for the XSS payload to execute.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider applying web application firewall (WAF) rules to detect and block XSS payloads targeting this plugin and restrict access to affected endpoints where feasible.