CVE-2023-1861

Limit Login Attempts < 1.7.2 - Subscriber+ Stored XSS

The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back in the logs dashboard, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks

Affected

Limit Login Attempts

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

28.80% chance of exploitation in the next 30 days, 98th percentile

Published

2023-05-02

Updated

2025-01-30

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/461cbcca-aed7-4c92-ba35-ebabf4fcd810

References

• CVE Record
• NVD entry