Stored Cross-Site Scripting Vulnerability in Limit Login Attempts Plugin for WordPress

CVE-2023-1912

What is CVE-2023-1912?

The Limit Login Attempts plugin for WordPress presents a stored cross-site scripting vulnerability due to inadequate input validation and output encoding in its lock logging feature. When versions up to 1.7.1 are used, unauthenticated attackers can inject malicious scripts, executing these scripts whenever an administrator accesses the plugin's settings page. This vulnerability is specifically triggered when the plugin's settings prioritize the X-FORWARDED-FOR header, allowing attackers to exploit the plugin's mechanisms.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References