Bug, div etc. output within head tag

The plugin outputs div, p, img, form etc. tags directly in head tag in WordPress login page, this causes invalid html.

function wp_limit_login_head(){
    ...
?>
    <script>var popup_flag = "<?php  echo $_SESSION["popup_flag"] ?>";</script>
    <div class='popup' style="display: none;">
      <div class='popup_box'>
          <p class='x' id='x'> &times </p>
          <p>Please enter captcha text</p>
          <img class="captcha" src="<?php echo  plugin_dir_url( __FILE__ ).'/captcha.php';?>" />
          <form class="captcha_form" action="" method="GET">
              <input type="text" placeholder="Enter here.." name="captcha">
              <input class="submit" type="submit" value="Submit">
          </form>
      </div>
    </div>
<?php 
}

add_action('login_head', 'wp_limit_login_head');

Suggested fix: Output html in login_header (note the er at the end) or login_footer action.

Plugin version 2.6.4.