163 matches found
Limit Login Attempts WordPress - Stored Cross-site Scripting
Limit Login Attempts WordPress plugin 4.0.50 contains a stored cross-site scripting caused by not escaping IP addresses controlled via headers like X-Forwarded-For before outputting them in reports, letting unauthenticated attackers execute scripts in admin context. id: CVE-2021-24657 info: name:...
Limit Login Attempts - Stored Cross-Site Scripting
Limit Login Attempts WordPress plugin 4.0.72 contains a stored cross-site scripting caused by unsanitized and unescaped settings, letting malicious administrators inject Javascript code, exploit requires administrator privileges. id: CVE-2022-1029 info: name: Limit Login Attempts - Stored...
WordPress Limit Login Attempts Security plugin < 3.4.1 - Two-Factor Authentication Bypass vulnerability
Two-Factor Authentication Bypass vulnerability discovered by Qi Qin in WordPress Plugin Limit Login Attempts Reloaded versions 3.4.1...
WordPress Limit Login Attempts Security plugin < 3.4.1 - Two-Factor Authentication Bypass vulnerability
Two-Factor Authentication Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Limit Login Attempts Reloaded versions 3.4.1...
CVE-2026-118201
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access...
CVE-2026-118202
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by...
EUVD-2026-119822
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access...
CVE-2026-118201
The Limit Login Attempts Security WordPress plugin (versions
CVE-2026-118202 Limit Login Attempts Reloaded < 3.4.1 - Two-Factor Authentication Bypass via Malformed X-Forwarded-For Header
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by...
CVE-2026-118202
The Limit Login Attempts Security WordPress plugin (versions prior to 3.4.1 ) is vulnerable to a Two-Factor Authentication (2FA) bypass . The root cause is that the plugin fails to verify the success of the 2FA step before completing a login and incorrectly treats a failure to build that step as ...
CVE-2026-118201 Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPC
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access...
CVE-2026-118201 Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPC
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access...
CVE-2026-118202 Limit Login Attempts Reloaded < 3.4.1 - Two-Factor Authentication Bypass via Malformed X-Forwarded-For Header
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by...
EUVD-2026-119823
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by...
CVE-2020-35590
Exploit Information Exploit Title: WordPress Plugin Limit Login Attempts Reloaded 2.13.0 - Login Limit Bypass CVE: CVE-2020-35590 Date: 2020-06-09 Exploit Author: N4nj0 Software Link: https://wordpress.org/plugins/limit-login-attempts-reloaded/ Version: 2.13.0 Tested on: WordPress 5.4.1, 5.4.2...
CVE-2026-93622
Unauthenticated Cross Site Scripting XSS in WPS Limit Login = 1.5.9.3 versions...
CVE-2026-93622 WordPress WPS Limit Login plugin <= 1.5.9.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WPS Limit Login = 1.5.9.3 versions...
CVE-2026-93622 WordPress WPS Limit Login plugin <= 1.5.9.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WPS Limit Login = 1.5.9.3 versions...
WordPress WPS Limit Login plugin <= 1.5.9.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WPS Limit Login versions = 1.5.9.3...
WordPress Limit Login Attempts Security plugin < 3.3.5 - Username Denylist Bypass vulnerability
Username Denylist Bypass vulnerability discovered by Artus KG in WordPress Plugin Limit Login Attempts Reloaded versions 3.3.5...