WordPress Limit Login Attempts Security plugin < 3.4.1 - Two-Factor Authentication Bypass vulnerability

Two-Factor Authentication Bypass vulnerability discovered by Qi Qin in WordPress Plugin Limit Login Attempts Reloaded versions 3.4.1...

WordPress Limit Login Attempts Security plugin < 3.4.1 - Two-Factor Authentication Bypass vulnerability

Two-Factor Authentication Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Limit Login Attempts Reloaded versions 3.4.1...

CVE-2026-118201

The Limit Login Attempts Security WordPress plugin (versions

CVE-2026-118202 Limit Login Attempts Reloaded < 3.4.1 - Two-Factor Authentication Bypass via Malformed X-Forwarded-For Header

The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by...

CVE-2026-118202

The Limit Login Attempts Security WordPress plugin (versions prior to 3.4.1 ) is vulnerable to a Two-Factor Authentication (2FA) bypass . The root cause is that the plugin fails to verify the success of the 2FA step before completing a login and incorrectly treats a failure to build that step as ...

CVE-2026-118201 Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPC

The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access...

CVE-2026-118201 Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPC

The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access...

CVE-2026-118202 Limit Login Attempts Reloaded < 3.4.1 - Two-Factor Authentication Bypass via Malformed X-Forwarded-For Header

The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by...

CVE-2026-18356

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 contains a bypass in its username denylist mechanism. The plugin fails to compare login attempts against the denylist case-insensitively and does not account for the account's email address , allowing an account that an administrator...

PT-2026-79371

Name of the Vulnerable Software and Affected Versions Limit Login Attempts Reloaded versions prior to 3.3.5 Description The plugin fails to perform case-insensitive comparisons when checking logins against the username denylist and does not consider the account email address. This allows blocked...

CVE-2026-18356: Incomplete List of Disallowed Inputs

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway...

PT-2024-15129

Name of the Vulnerable Software and Affected Versions Limit Login Attempts Reloaded plugin for WordPress versions up to, and including, 2.25.26 Description The issue is related to Stored Cross-Site Scripting via the plugin's shortcodes due to insufficient input sanitization and output escaping on...

WordPress Plugin Limit Login Attempts Reloaded Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

CVE-2023-6934: Improper Neutralization of Input During Web Page Generation

The Limit Login Attempts Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.25.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Limit Login Attempts Reloaded Plugin <= 2.25.26 is vulnerable to Cross Site Scripting (XSS)

Software Limit Login Attempts Reloaded Type Plugin Vulnerable versions = 2.25.26 Fixed in 2.25.27 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6934 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2de2d139dd65 Credits Hung...

WordPress Limit Login Attempts Reloaded Plugin < 2.25.26 Missing Authorization Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:limitloginattempts:limitloginattemptsreloaded"; if descripti...

CVE-2023-5525 Limit Login Attempts Reloaded < 2.25.26 - Admin+ Missing Authorization to Toggle Plugin Auto-Update

The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the toggleautoupdate AJAX action, allowing any user with a valid nonce to toggle the auto-update status of the plugin...

CVE-2023-5525: Missing Authorization

The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the toggleautoupdate AJAX action, allowing any user with a valid nonce to toggle the auto-update status of the plugin...

Wordpress limit-login-attempts-reloaded cross-site scripting vulnerability

Wordpress limit-login-attempts-reloaded is a Wordpress Foundation plugin that provides login restrictions for Wordpress. The plugin provides platform administrators with login restriction policies to safeguard account security as well as platform stability. A security vulnerability exists in...

CVE-2020-35590

LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of per IP address rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious...