CVE-2022-1029 Limit Login Attempts < 4.0.72 - Admin+ Stored Cross-Site Scripting

The Limit Login Attempts WordPress plugin before 4.0.72 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfilteredhtml is disallowed for example in multisite...

CVE-2022-1029

The CVE-2022-1029 entry corresponds to a stored XSS in the Limit Login Attempts WordPress plugin prior to 4.0.72. The vulnerability arises from unsanitized/unescaped settings, enabling administrators to inject JavaScript when unfiltered_html is disallowed (e.g., multisite). Connected documents pr...