CVE-2023-1912
Published: 06 April 2023
Summary
CVE-2023-1912 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Limit Login Attempts Project Limit Login Attempts. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 11.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Limit Login Attempts plugin for WordPress is vulnerable to stored cross-site scripting in versions up to and including 1.7.1. The flaw resides in the lock logging feature and stems from insufficient input sanitization and output escaping on values derived from the X-FORWARDED-FOR header when that header is configured as the prioritized source for client IP addresses. The issue is tracked as CWE-79 and carries a CVSS 3.1 score of 7.2.
Unauthenticated attackers can supply a crafted X-FORWARDED-FOR header that stores an arbitrary script in the plugin’s logs. The script executes in the browser of any administrator who later visits the plugin’s settings page, enabling session hijacking or other actions within the WordPress administrative interface. Exploitation requires the plugin’s option to prefer the X-FORWARDED-FOR header to be enabled.
The vendor addressed the vulnerability in version 1.7.2, released via the WordPress plugin repository. Public advisories from Wordfence and the plugin’s changelog recommend immediate upgrade for the roughly 600,000 sites reported to use the plugin. No additional configuration changes or workarounds are documented beyond the version update.
EPSS scores for the CVE remained low, reaching a peak of 0.0531 before receding to the current value of 0.0391.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-24100
Vulnerability details
The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
more
to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the plugin's settings page. This only works when the plugin prioritizes use of the X-FORWARDED-FOR header, which can be configured in its settings.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.