Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-118439

Limit Login Attempts Reloaded < 3.4.2 - Admin+ SSRF via App Setup Code

The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones (SSRF).

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Limit Login Attempts Reloaded
CVE-2026-118201

Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPC

The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access without completing the second factor.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Limit Login Attempts Reloaded
CVE-2026-118202

Limit Login Attempts Reloaded < 3.4.1 - Two-Factor Authentication Bypass via Malformed X-Forwarded-For Header

The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by sending a request header that breaks the step.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Limit Login Attempts Reloaded