CVE-2022-1029

4.8 mediumEPSS 0.9%

Medium (4.8) in miniorange limit login attempts. EPSS 0.9% chance of exploitation in the next 30 days.

The Limit Login Attempts WordPress plugin before 4.0.72 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-06-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

miniorange:limit_login_attempts

References

https://wpscan.com/vulnerability/0e74eeb4-89e2-4873-904f-ad4f25c4a8ba
https://wpscan.com/vulnerability/0e74eeb4-89e2-4873-904f-ad4f25c4a8ba

Check your stack JSON