CVE-2020-35589

The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed b...

CVE-2020-35589

The CVE-2020-35589 entry concerns the WordPress plugin limit-login-attempts-reloaded, specifically versions before 2.17.4. The vulnerability is a reflected XSS on wp-admin/options-general.php?page=limit-login-attempts&tab=, triggered by a crafted parameter (often via a URL). Exploitation can caus...