The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected Cross-Site Scripting issue.
CVSS 3.1MEDIUM 6.1·Network·No auth·User interaction·EPSS 0.01623·Published 2021-05-05·Fixed in 3.8.2CWE-79