THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-2487 (MEDIUM 4.4) — The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrat

[NVD] CVE-2026-2487 (MEDIUM 4.4) — The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrat

mednvdPublished 2026-08-16

CVE-2026-2487 CVSS: 4.4 MEDIUM Published: 2026-08-16T04:16:27.943

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary w

Indicators of compromise

CVE-2026-2487cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-2487