Stored Cross-Site Scripting Vulnerability in Limit Login Attempts Reloaded Plugin for WordPress
CVE-2023-6934

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Limit Login Attempts Reloaded – Login Security, 2fa, Brute Force Protection & Firewall
Vendor
CVE Published:
11 January 2024

What is CVE-2023-6934?

The Limit Login Attempts Reloaded plugin for WordPress exhibits a vulnerability that allows authenticated attackers with contributor-level permissions and above to exploit stored cross-site scripting. This is due to inadequate input sanitization and output escaping for user-supplied attributes in the plugin's shortcodes. As a result, attackers can inject arbitrary web scripts into pages, which can execute whenever a user accesses the affected page, potentially compromising site integrity and user data.

Affected Version(s)

Limit Login Attempts Reloaded – Login Security, 2FA, Brute Force Protection & Firewall 0 <= 2.25.26

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.svn.wordpress.org/limit-login-attempts-re...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hung -mov Nguyen
.