CVE-2023-1912

🗓️ 06 Apr 2023 14:37:58Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 61 Views🌐 WEB

Limit Login Attempts plugin for WordPress, Stored XSS vulnerability in versions up to 1.7.

Reporter	Title	Published	Views	Family All 18
0day.today	WordPress Limit Login Attempts 1.7.1 Cross Site Scripting Vulnerability	12 Apr 202300:00	–	zdt
ATTACKERKB	CVE-2023-1912	6 Apr 202315:15	–	attackerkb
Circl	CVE-2023-1912	6 Apr 202318:27	–	circl
CNNVD	WordPress plugin Limit Login Attempts 跨站脚本漏洞	6 Apr 202300:00	–	cnnvd
Cvelist	CVE-2023-1912 Limit Login Attempts <= 1.7.1 - Unauthenticated Stored Cross-Site Scripting	6 Apr 202314:37	–	cvelist
EUVD	EUVD-2023-24100	3 Oct 202520:07	–	euvd
NVD	CVE-2023-1912	6 Apr 202315:15	–	nvd
OSV	CVE-2023-1912	6 Apr 202315:15	–	osv
Packet Storm	WordPress Limit Login Attempts 1.7.1 Cross Site Scripting	12 Apr 202300:00	–	packetstorm
Patchstack	WordPress Limit Login Attempts Plugin <= 1.7.1 is vulnerable to Cross Site Scripting (XSS)	7 Apr 202300:00	–	patchstack

NVD

Vulners

Node

limit_login_attempts_project limit_login_attemptsRange≤1.7.1wordpress

[
  {
    "vendor": "automattic",
    "product": "Limit Login Attempts",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.7.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/cb8c80fc-3b51-4003-b221-6f02e74bead0
pluginvulnerabilities	www.pluginvulnerabilities.com/2018/03/09/one-of-the-ten-most-popular-wordpress-plugins-isnt-needed-and-introduces-a-vulnerability-on-some-websites-using-it/
plugins	www.plugins.trac.wordpress.org/changeset
wordfence	www.wordfence.com/blog/2023/04/update-now-severe-vulnerability-impacting-600000-sites-patched-in-limit-login-attempts/
packetstormsecurity	www.packetstormsecurity.com/files/171824/WordPress-Limit-Login-Attempts-1.7.1-Cross-Site-Scripting.html

Parameter	Position	Path	Description	CWE
X-Forwarded-For	header	wp-login.php	Stored Cross-Site Scripting via login attempts when X-Forwarded-For header is used, leading to script execution in admin logs.	CWE-79
page	path	wp-admin/options-general.php	Admin logs page stores/display user-supplied data from headers, enabling stored XSS when viewing logs affected by X-Forwarded-For input.	CWE-79

08 Apr 2026 19:18Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.1 - 7.2

EPSS0.03906

SSVC

CWE-79