CVE-2021-24657CWE-79

Limit Login Attempts < 4.0.50 - Unauthenticated Stored Cross-Site Scripting

published September 20, 2021

CVSS
—
EPSS
2%
Percentile
75.4
In the wild
Unconfirmed
What it is

The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01582 · 75.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-09-20T10:06Z
EPSS history
Timeline
  • 20 SEP 10:06Z
    Limit Login Attempts < 4.0.50 - Unauthenticated Stored Cross-Site Scripting
    cvelistv5