What’s Vulnerable › Vulnerabilities

CVE-2020-35589

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-12-21 · updated 2026-06-17
• Weakness: CWE-79

Description

The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims.

Affected products

• wpchefgadget Limit Login Attempts Reloaded – Login Security, 2FA, Brute Force Protection & Firewall: before 2.17.4 — fixed in 2.17.4

How to fix

Upgrade to a fixed version: wpchefgadget Limit Login Attempts Reloaded – Login Security, 2FA, Brute Force Protection & Firewall 2.17.4. Check the vendor advisory for mitigations.

References

• https://n4nj0.github.io/advisories/wordpress-plugin-limit-login-attempts-reloaded/
• https://wordpress.org/plugins/limit-login-attempts-reloaded/#developers
• https://n4nj0.github.io/advisories/wordpress-plugin-limit-login-attempts-reloaded/
• https://wordpress.org/plugins/limit-login-attempts-reloaded/#developers

Get alerted when CVE-2020-35589 or the next vulnerability affects your stack