CVE-2023-1861

medium · 5.4

The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back in the logs dashboard, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks

5.4

CVSS

28.8%

EPSS (exploit prob.)

98th

EPSS percentile

2023-05-02

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-79

Affected products

Vendor	Product	Affected versions
limit_login_attempts_project	limit_login_attempts	<= 1.7.2

Check a specific version with /api/v1/cve/match.

References

https://wpscan.com/vulnerability/461cbcca-aed7-4c92-ba35-ebabf4fcd810
https://wpscan.com/vulnerability/461cbcca-aed7-4c92-ba35-ebabf4fcd810

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-1861