The White Label CMS WordPress plugin before 2.2.9 does not sanitise and validate the wlcms_login_custom_js parameter before outputting it back in the response while previewing leading to a Reflected Cross-Site Scripting issue