The Limit Login Attempts WordPress plugin prior to 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
limit login attempts project limit login attempts |
Vulmon