CVE-2021-24657: Limit Login Attempts < 4.0.50 - Unauthenticated Stored Cross-Site Scripting
Published Sep 20, 2021
·Updated
The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue.
Affected Software
1 affected component
Limit Login Attempts Project Limit Login Attempts Wordpress<4.0.50
Event History
Sep 20, 2021
CVE Published
via MITRE·10:06 AM
Data Sourced
via MITRE·10:06 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-24657.
2
What is the severity of CVE-2021-24657?
The severity of CVE-2021-24657 is medium with a CVSS score of 6.1.
3
What is the affected software?
The affected software is the Limit Login Attempts WordPress plugin version up to 4.0.50.
4
What is the impact of this vulnerability?
This vulnerability can lead to an Unauthenticated Stored Cross-Site Scripting issue.
5
Is there a fix available for this vulnerability?
Yes, upgrading to version 4.0.50 or later of the Limit Login Attempts WordPress plugin fixes this vulnerability.