title: Limit Login Attempts < 4.0.50 - Unauthenticated Stored Cross-Site Scripting
description: The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Limit Login Attempts
vendor: Unknown
versions:
lessThan: 4.0.50, status: affected, version: 4.0.50, versionType: custom
}