WordPress CVEs

Description

The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue.

Affected WordPress components

• Limit Login Attempts Plugin · limit-login-attempts
  Possible match Abandoned
  From 4.0.50 (including) to 4.0.50 (excluding)
  View on WordPress.org
• Limit Login Attempts Plugin · login-attempt-limit
  Possible match Abandoned
  From 4.0.50 (including) to 4.0.50 (excluding)
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• Unknown Limit Login Attempts — From 4.0.50 (including) to 4.0.50 (excluding)
• limit_login_attempts_project limit_login_attempts — Before 4.0.50

References

• wpscan.com https://wpscan.com/vulnerability/c789ca04-d88c-4789-8be1-812888f0c8f8 Exploit, Third Party Advisory
• nvd.nist.gov Official NVD record