CVE-2023-4800: Undefined Security Weakness

The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users...

WordPress plugin DoLogin Security security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2023-30664 · WordPress · Dologin Security

Name of the Vulnerable Software and Affected Versions: DoLogin Security WordPress plugin versions prior to 3.7.1 Description: The issue concerns the DoLogin Security WordPress plugin, which does not restrict access to a widget showing IPs of failed logins to low-privileged users. This could...

WordPress DoLogin Security Plugin < 3.7 is vulnerable to Cross Site Scripting (XSS)

Software DoLogin Security Type Plugin Vulnerable versions 3.7 Fixed in 3.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4549 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ea7d8ad59ce2 Credits Bartlomiej Marek and...

CVE-2023-4631

The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing...

Cross site scripting

The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form...

CVE-2023-4549

CVE-2023-4549 concerns the DoLogin Security WordPress plugin, affected versions prior to 3.7. The vulnerability stems from improper sanitization of IPs from the X-Forwarded-For header, enabling a stored Cross-Site Scripting (XSS) attack through WordPress’ login form. Public references in the prov...

CVE-2023-4549 DoLogin Security < 3.7 - Unauthenticated Stored Cross-Site Scripting

The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form...

CVE-2023-4631 DoLogin Security < 3.7 - IP Spoofing

The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing...

CVE-2023-4631 DoLogin Security < 3.7 - IP Spoofing

The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing...

CVE-2023-4631

The DoLogin Security WordPress plugin (versions prior to 3.7) is affected. The root cause is the plugin using headers like X-Forwarded-For to obtain the request IP, which can enable IP spoofing. Public sources (NVD/Red Hat and related advisories) indicate the affected product and version, with CV...

CVE-2023-4549: Undefined Security Weakness

The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form...

PT-2023-29951 · WordPress · Dologin Security

Name of the Vulnerable Software and Affected Versions: DoLogin Security WordPress plugin versions prior to 3.7 Description: The issue allows IP spoofing by using headers such as the X-Forwarded-For to retrieve the IP address of the request. Recommendations: For versions prior to 3.7, update to...

WordPress plugin DoLogin Security Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

WordPress plugin DoLogin Security security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.WordPress plugin i...

CVE-2023-4631: Undefined Security Weakness

The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing...

DoLogin Security < 3.7.1 - Subscriber+ IP Address leak

Description The plugin does not restrict the access of a widget that shows the IPs of failed logins to low privileged users. Just login to subscriber account and go to: http://localhost/wp-admin/index.phplog...

DoLogin Security < 3.7.1 - Subscriber+ IP Address leak

Description The plugin does not restrict the access of a widget that shows the IPs of failed logins to low privileged users. PoC Just login to subscriber account and go to: http://localhost/wp-admin/index.phplog...

DoLogin Security < 3.7 - IP Spoofing

Description The plugin uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing. PoC 1. Send login request with x-forwarded-for: REDACTEDIP 2. See spoofed IP address in the "Login Attempts Log"...

DoLogin Security < 3.7 - Unauthenticated Stored Cross-Site Scripting

Description The plugin does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form. 1. Put javascript payload on html.cafe. const url = 'https://s…t/wp-admin/user-new.php'; fetchurl...