Vulnerabilities and security researches for limit-login-attempts-reloaded

Jun 07, 2024

CVE, Research URL: CVE-2020-35589
Home page URL: Security reports for Limit Login Attempts Reloaded
Application: Limit Login Attempts Reloaded
Date: Dec 21, 2020
Research Description: The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2020-35590
Home page URL: Security reports for Limit Login Attempts Reloaded
Application: Limit Login Attempts Reloaded
Date: Dec 21, 2020
Research Description: LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious user is not limited to perform a brute force attack, because the client IP header accepts any arbitrary string. When randomizing the header input, the login count does not ever reach the maximum allowed retries.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2023-6934
Home page URL: Security reports for Limit Login Attempts Reloaded
Application: Limit Login Attempts Reloaded
Date: Jan 11, 2024
Research Description: The Limit Login Attempts Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 2.25.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2023-5525
Home page URL: Security reports for Limit Login Attempts Reloaded
Application: Limit Login Attempts Reloaded
Date: Nov 27, 2023
Research Description: The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the `toggle_auto_update` AJAX action, allowing any user with a valid nonce to toggle the auto-update status of the plugin.
Affected versions: Min -, max -.
Status: vulnerable

PSC, Research URL: PSC-2024-64538
Home page URL: Security reports for Limit Login Attempts Reloaded
Application: Limit Login Attempts Reloaded
Date: -
Research Description: Limit Login Attempts Reloaded is a comprehensive plugin designed to fortify your WordPress site against brute force attacks by limiting the number of login attempts. With over 2.5 million downloads, it’s a proven solution for login security that supports various login methods, including XMLRPC, WooCommerce, and custom login pages. The plugin’s innovative design effectively mitigates vulnerabilities inherent in WordPress’s default unlimited login attempts, thereby significantly enhancing your website’s defense mechanisms. Limit Login Attempts Reloaded has undergone rigorous security testing and successfully obtained the prestigious Plugin Security Certification (PSC) from CleanTalk. This certification highlights its commitment to maintaining stringent security standards and providing robust protection for its users.
Affected versions: Min -, max -.
Status: SAFE & CERTIFIED