EIP-2026-114154

This is a proof-of-concept for a stored Cross-Site Scripting (XSS) vulnerability in the User Login Log WordPress Plugin. The exploit leverages the lack of encoding of the User-Agent HTTP request header to inject malicious JavaScript, which can steal session tokens or perform arbitrary actions on behalf of users.