CVE-2023-1912

🗓️ 06 Apr 2023 14:37:58Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 70 Views🌐 WEB

Limit Login Attempts plugin for WordPress, Stored XSS vulnerability in versions up to 1.7.

Reporter	Title	Published	Views	Family All 18
0day.today	WordPress Limit Login Attempts 1.7.1 Cross Site Scripting Vulnerability	12 Apr 202300:00	–	zdt
ATTACKERKB	CVE-2023-1912	6 Apr 202315:15	–	attackerkb
Circl	CVE-2023-1912	6 Apr 202318:27	–	circl
CNNVD	WordPress plugin Limit Login Attempts 跨站脚本漏洞	6 Apr 202300:00	–	cnnvd
Cvelist	CVE-2023-1912 Limit Login Attempts <= 1.7.1 - Unauthenticated Stored Cross-Site Scripting	6 Apr 202314:37	–	cvelist
EUVD	EUVD-2023-24100	3 Oct 202520:07	–	euvd
NVD	CVE-2023-1912	6 Apr 202315:15	–	nvd
OSV	CVE-2023-1912	6 Apr 202315:15	–	osv
Packet Storm	WordPress Limit Login Attempts 1.7.1 Cross Site Scripting	12 Apr 202300:00	–	packetstorm
Patchstack	WordPress Limit Login Attempts Plugin <= 1.7.1 is vulnerable to Cross Site Scripting (XSS)	7 Apr 202300:00	–	patchstack

NVD

Vulners

Node

limit_login_attempts_project limit_login_attemptsRange≤1.7.1wordpress

[
  {
    "vendor": "automattic",
    "product": "Limit Login Attempts",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.7.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/cb8c80fc-3b51-4003-b221-6f02e74bead0
pluginvulnerabilities	www.pluginvulnerabilities.com/2018/03/09/one-of-the-ten-most-popular-wordpress-plugins-isnt-needed-and-introduces-a-vulnerability-on-some-websites-using-it/
plugins	www.plugins.trac.wordpress.org/changeset
wordfence	www.wordfence.com/blog/2023/04/update-now-severe-vulnerability-impacting-600000-sites-patched-in-limit-login-attempts/
packetstormsecurity	www.packetstormsecurity.com/files/171824/WordPress-Limit-Login-Attempts-1.7.1-Cross-Site-Scripting.html

Parameter	Position	Path	Description	CWE
X-Forwarded-For	header	wp-login.php	Stored Cross-Site Scripting via unsafely echoed X-Forwarded-For header during login attempts; when logs are viewed on the admin page, the injected script executes.	CWE-79
X-Forwarded-For	path	wp-admin/options-general.php?page=limit-login-attempts	Stored Cross-Site Scripting in the logs displayed on the Limit Login Attempts settings page due to insufficient input sanitization/escaping when X-Forwarded-For header contains script.	CWE-79
log	path	wp-admin/options-general.php?page=limit-login-attempts	Stored Cross-Site Scripting in the logs displayed on the Limit Login Attempts settings page due to insufficient input sanitization/escaping when X-Forwarded-For header contains script.	CWE-79
wp-submit	path	wp-admin/options-general.php?page=limit-login-attempts	Stored Cross-Site Scripting in the logs displayed on the Limit Login Attempts settings page due to insufficient input sanitization/escaping when X-Forwarded-For header contains script.	CWE-79
testcookie	path	wp-admin/options-general.php?page=limit-login-attempts	Stored Cross-Site Scripting in the logs displayed on the Limit Login Attempts settings page due to insufficient input sanitization/escaping when X-Forwarded-For header contains script.	CWE-79

17 Jun 2026 05:29Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.1 - 7.2

EPSS0.00789

SSVC

CWE-79