CVE-2023-1861

PoC —

CVSS 3.1

5.4 medium

EPSS

29%p98

Published

May 2, 2023 (May 2, 2023)

Modified

Jun 17, 2026

Description

The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back in the logs dashboard, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks

Vendors: limit login attempts project
Products: limit login attempts
Ecosystems: WordPress
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (28.8%)

In the news0 stories

No ingested article mentions this CVE yet.