CVE-2023-1912: Limit Login Attempts <= 1.7.1 - Unauthenticated Stored Cross-Site Scripting
The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the plugin's settings page. This only works when the plugin prioritizes use of the X-FORWARDED-FOR header, which can be configured in its settings.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-1912?
CVE-2023-1912 is a vulnerability in the Limit Login Attempts plugin for WordPress that allows for stored cross-site scripting attacks.
How does CVE-2023-1912 affect me?
CVE-2023-1912 affects you if you are using the Limit Login Attempts plugin for WordPress versions up to and including 1.7.1.
What is the severity of CVE-2023-1912?
CVE-2023-1912 has a severity score of 6.1, which is considered high.
How can I fix CVE-2023-1912?
To fix CVE-2023-1912, you should update the Limit Login Attempts plugin to version 1.7.2 or newer.
Where can I find more information about CVE-2023-1912?
More information about CVE-2023-1912 can be found at the following references: [reference 1](http://packetstormsecurity.com/files/171824/WordPress-Limit-Login-Attempts-1.7.1-Cross-Site-Scripting.html), [reference 2](https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=551920%40limit-login-attempts%2Ftags%2F1.7.1&new=2893850%40limit-login-attempts%2Ftags%2F1.7.2), [reference 3](https://www.pluginvulnerabilities.com/2018/03/09/one-of-the-ten-most-popular-wordpress-plugins-isnt-needed-and-introduces-a-vulnerability-on-some-websites-using-it/)