Erident Custom Login and Dashboard < 3.5.9 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them (even when the unfileted_html is disabled)

Use a payload such as a"><img src onerror=alert(/XSS/)> in the plugin settings (for example, the Powered by Text input)