CVE-2021-24657
Medium
Description
The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue.
SeverityMedium
CVSS6.1
Exploit probability—
ProductLimit Login Attempts
PublishedSep 20, 2021
First seenSep 20, 2021
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- limit_login_attempts_project limit_login_attempts4.0.50 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| limit_login_attempts_project limit_login_attempts | v < 4.0.50 | 4.0.50 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.