Wps Limit Login
Monthly
Unauthenticated reflected cross-site scripting in the WordPress plugin WPS Limit Login (versions up to and including 1.5.9.3) lets a remote attacker craft a URL that injects script into a page served by the affected site, executing in the browser of any victim who loads the link. Because the injected script runs in the site's origin, an attacker could hijack an authenticated administrator's session, perform actions as that user, or redirect visitors, though exploitation is not automatic - it requires the victim to interact with the crafted link, and impact is confined to the client-side browser session rather than the WordPress server. The flaw carries a CVSS 3.1 base score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and no public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported through Patchstack's vulnerability disclosure program.
Unauthenticated reflected cross-site scripting in the WordPress plugin WPS Limit Login (versions up to and including 1.5.9.3) lets a remote attacker craft a URL that injects script into a page served by the affected site, executing in the browser of any victim who loads the link. Because the injected script runs in the site's origin, an attacker could hijack an authenticated administrator's session, perform actions as that user, or redirect visitors, though exploitation is not automatic - it requires the victim to interact with the crafted link, and impact is confined to the client-side browser session rather than the WordPress server. The flaw carries a CVSS 3.1 base score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and no public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported through Patchstack's vulnerability disclosure program.