Threat Entry Updated 2024-11-21

CVE-2023-6934 - Limit Login Attempts Reloaded Plugin

The Limit Login Attempts Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 2.25.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Limit Login Attempts Reloaded

CVE-2023-6934

MEDIUM CVSS 6.4 2024-01-11

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2023-5525 - Limit Login Attempts Reloaded Plugin

The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the `toggle_auto_update` AJAX action, allowing any user with a valid nonce to toggle the auto-update status of the plugin.

PLUGIN Limit Login Attempts Reloaded

CVE-2023-5525

MEDIUM CVSS 4.3 2023-11-27

Risk Score

Open Full Technical Breakdown