CVE-2023-1861

The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back in the logs dashboard, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

28.80% chance of exploitation in the next 30 days, 98th percentile

Published

2023-05-02

Updated

2025-01-30

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/461cbcca-aed7-4c92-ba35-ebabf4fcd810

References

• CVE Record
• NVD entry

Related

• CVE-2023-1857
• CVE-2023-1874
• CVE-2023-1856
• CVE-2023-1875
• CVE-2023-1854
• CVE-2023-1877