VulnerabilityModified
CVE-2021-24657
The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an…
MEDIUM 6.1EPSS 1.58%
Does this matter?
Lower severity and a low EPSS score (1.58%). Track it; it rarely justifies an emergency change on its own.
Description
The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.58% probability · 74th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- limit login attempts project/limit login attempts
- Source
- contact@wpscan.com
References
- https://wpscan.com/vulnerability/c789ca04-d88c-4789-8be1-812888f0c8f8Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/c789ca04-d88c-4789-8be1-812888f0c8f8Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.