CVE-2022-1029: Limit Login Attempts < 4.0.72 - Admin+ Stored Cross-Site Scripting
Published Jun 27, 2022
·Updated
The Limit Login Attempts WordPress plugin before 4.0.72 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfilteredhtml is disallowed (for example in multisite setup)
Affected Software
1 affected component
miniOrange Limit Login Attempts Wordpress<4.0.72
Event History
Jun 27, 2022
CVE Published
via MITRE·08:56 AM
Data Sourced
via MITRE·08:56 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for the Limit Login Attempts WordPress plugin?
The vulnerability ID for the Limit Login Attempts WordPress plugin is CVE-2022-1029.
2
What is the severity of CVE-2022-1029?
The severity of CVE-2022-1029 is medium with a CVSS score of 4.8.
3
Which version of the Limit Login Attempts WordPress plugin is affected by CVE-2022-1029?
The Limit Login Attempts WordPress plugin version up to 4.0.72 is affected by CVE-2022-1029.
4
What is the CWE category of CVE-2022-1029?
The CWE category of CVE-2022-1029 is CWE-79 (Cross-Site Scripting).
5
How can I fix CVE-2022-1029?
To fix CVE-2022-1029, update the Limit Login Attempts WordPress plugin to version 4.0.72 or above.