ByteOS Network

NVD Vulnerability Details :

CVE-2020-35589

Analyzed

Source-cve@mitre.org

Published At-21 Dec, 2020 | 07:15

Updated At-22 Dec, 2020 | 19:53

The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary	2.0	3.5	LOW	AV:N/AC:M/Au:S/C:N/I:P/A:N

CPE Matches

limitloginattempts>>limit_login_attempts_reloaded>>Versions before 2.17.4(exclusive)

cpe:2.3:a:limitloginattempts:limit_login_attempts_reloaded:*:*:*:*:*:wordpress:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://n4nj0.github.io/advisories/wordpress-plugin-limit-login-attempts-reloaded/	cve@mitre.org	Exploit Third Party Advisory
https://wordpress.org/plugins/limit-login-attempts-reloaded/#developers	cve@mitre.org	Product Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History