CVE-2025-28914: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the wordpress login form to anywhere plugin through version 0.2. The vulnerability, tracked as CVE-2025-28914, was discovered by Nabil Irawan and publicly disclosed on March 11, 2025. This security issue affects the WordPress plugin developed by Ajay Sharma (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has been assigned a CVSS v3.1 base score of 5.9 (Medium). The attack vector requires high privileges and user interaction, with the potential to impact confidentiality, integrity, and availability at a low level. The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L (NVD).

If exploited, this vulnerability could allow an authenticated attacker with administrator privileges to inject malicious scripts into the website. These scripts would be executed when users visit the affected pages, potentially leading to unauthorized data modifications, redirects, or injection of unwanted advertisements (Patchstack).

The vulnerability requires administrator-level access to exploit, which significantly limits its potential impact. It was reported on February 21, 2025, and publicly disclosed on March 11, 2025 (Patchstack).

As of the disclosure date, no official fix has been released for this vulnerability. Given the low severity impact and unlikely exploitation potential, the vulnerability has been classified as low priority for virtual patching (Patchstack).