Lucene search

K

Limit Login Attempts Security Vulnerabilities

cve
cve

CVE-2023-6934

The Limit Login Attempts Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 2.25.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

6.4CVSS

5.2AI Score

0.001EPSS

2024-01-11 09:15 AM
36
cve
cve

CVE-2023-5525

The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the toggle_auto_update AJAX action, allowing any user with a valid nonce to toggle the auto-update status of the...

4.3CVSS

4.5AI Score

0.0004EPSS

2023-11-27 05:15 PM
33
cve
cve

CVE-2022-47138

Cross-Site Request Forgery (CSRF) vulnerability in German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin <= 2.1...

8.8CVSS

8.8AI Score

0.001EPSS

2023-05-25 09:15 AM
26
cve
cve

CVE-2023-1861

The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back in the logs dashboard, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting...

5.4CVSS

5.4AI Score

0.001EPSS

2023-05-02 08:15 AM
44
cve
cve

CVE-2023-1912

The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

7.2CVSS

5.8AI Score

0.002EPSS

2023-04-06 03:15 PM
32
cve
cve

CVE-2022-4303

The WP Limit Login Attempts WordPress plugin through 2.6.4 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based restrictions on login...

7.5CVSS

7.4AI Score

0.001EPSS

2023-01-23 03:15 PM
39
cve
cve

CVE-2022-1029

The Limit Login Attempts WordPress plugin before 4.0.72 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in...

4.8CVSS

4.9AI Score

0.001EPSS

2022-06-27 09:15 AM
53
7
cve
cve

CVE-2022-0787

The Limit Login Attempts (Spam Protection) WordPress plugin before 5.1 does not sanitise and escape some parameters before using them in SQL statements via AJAX actions (available to unauthenticated users), leading to SQL...

9.8CVSS

9.6AI Score

0.04EPSS

2022-03-28 06:15 PM
112
2
cve
cve

CVE-2021-24657

The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting...

6.1CVSS

5.9AI Score

0.002EPSS

2021-09-20 10:15 AM
19
cve
cve

CVE-2021-24194

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from...

8.8CVSS

8.6AI Score

0.001EPSS

2021-05-14 12:15 PM
22
2
cve
cve

CVE-2012-10001

The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote attackers to conduct brute-force authentication...

9.8CVSS

9.5AI Score

0.007EPSS

2021-01-06 03:15 PM
16
cve
cve

CVE-2020-35590

LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious....

9.8CVSS

9.4AI Score

0.002EPSS

2020-12-21 07:15 AM
42
11
cve
cve

CVE-2020-35589

The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by....

5.4CVSS

6.3AI Score

0.001EPSS

2020-12-21 07:15 AM
32
8
cve
cve

CVE-2015-6829

Multiple SQL injection vulnerabilities in the getip function in wp-limit-login-attempts.php in the WP Limit Login Attempts plugin before 2.0.1 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) X-Forwarded-For or (2) Client-IP HTTP...

8.9AI Score

0.005EPSS

2015-09-16 02:59 PM
18