nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2021-24657 CVE-2021-24657
MEDIUMNuclei
Limit Login Attempts < 4.0.50 - Unauthenticated Stored Cross-Site Scripting
Record summary
CVE-2021-24657 has a selected CVSS score of 6.1 (medium); EIP currently links 2 curated repository PoCs and 1 Nuclei template.
Description
The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue.
Description source: CVE List
Exploitation context
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Limit Login Attempts | CVE List | 4.0.50 to < 4.0.50 | affected |
Proofs of concept
2Curated repository PoCs
GitHubCVE-2021-24657Curated repository PoCby 0xd3vilStars: 127Not analyzed1 file
GitHubCVE-2021-24657Curated repository PoCby yubsyStars: 112Not analyzed1 file
Nuclei templates
1ProjectDiscoveryMEDIUMLimit Login Attempts WordPress - Stored Cross-site ScriptingCVSS 6.1
Limit Login Attempts WordPress plugin < 4.0.50 contains a stored cross-site scripting caused by not escaping IP addresses controlled via headers like X-Forwarded-For before outputting them in reports, letting unauthenticated attackers execute scripts in admin context.
Impact
Unauthenticated attackers can execute arbitrary scripts in admin browsers, potentially leading to session hijacking or defacement.
Remediation
Update to version 4.0.50 or later.
WeaknessesCWE-79
Authorstheamanrawat
Template tagscvecve2021wordpresswpwp-pluginminiorange-limit-login-attemptsxssauthenticated
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
https://wordpress.org/plugins/miniorange-limit-login-attempts https://nvd.nist.gov/vuln/detail/CVE-2021-24657
Source: ProjectDiscovery
References
2wpscan.com
https://wpscan.com/vulnerability/c789ca04-d88c-4789-8be1-812888f0c8f8