CVE-2025-58648
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Simple JWT Login WordPress plugin contains a stored XSS vulnerability. An attacker can inject malicious script that executes in the admin's browser.
Risk Assessment
Stored XSS can lead to admin session hijacking, data theft, or content modification.
Recommendation
Update the plugin to the latest version that includes the security fix.
Other vulnerabilities in Simple JWT Login
See all- CVE-2026-19714Critical
The Simple JWT Login WordPress plugin before version 3.6.8 does not validate the audience of Google identity tokens, allowing unauthenticated users to authenticate as any user whose email is in the token, including administrators. All sites with Google sign-in enabled are affected.
- CVE-2026-39793High
The Simple JWT Login plugin in version 4.0.0 contains a Broken Authentication vulnerability. The vulnerability can be exploited by a Subscriber-level user.
- CVE-2026-14262High
The Simple JWT Login plugin for WordPress up to version 3.6.6 contains an authentication bypass and privilege escalation vulnerability. An authenticated attacker with subscriber-level access can inject an administrator's email into the `payload` parameter, resulting in a JWT with admin identity and gaining a fully authenticated admin session.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Stored XSS.This issue affects Simple JWT Login: from n/a through <= 3.6.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS