CVE-2020-35589

The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims.

• CWE-79

• https://n4nj0.github.io/advisories/wordpress-plugin-limit-login-attempts-reloaded/Exploit, Third Party Advisory
• https://wordpress.org/plugins/limit-login-attempts-reloaded/#developersProduct, Third Party Advisory
• https://n4nj0.github.io/advisories/wordpress-plugin-limit-login-attempts-reloaded/Exploit, Third Party Advisory
• https://wordpress.org/plugins/limit-login-attempts-reloaded/#developersProduct, Third Party Advisory

Published

Dec 21, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-35582A stored cross-site scripting (XSS) issue in Envira Gallery …5.4
• CVE-2020-35584In Solstice Pod before 3.0.3, the web services allow users t…5.9
• CVE-2020-35585In Solstice Pod before 3.3.0 (or Open4.3), the screen key ca…7.5
• CVE-2020-35586In Solstice Pod before 3.3.0 (or Open4.3), the Administrator…7.5
• CVE-2020-35587In Solstice Pod before 3.0.3, the firmware can easily be dec…7.5
• CVE-2020-35588Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-3559A vulnerability in Cisco Aironet Access Point (AP) Software …8.6
• CVE-2020-35590LimitLoginAttempts.php in the limit-login-attempts-reloaded …9.8
• CVE-2020-35591Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation. The app…5.4
• CVE-2020-35592Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options heade…5.4
• CVE-2020-35593BMC PATROL Agent through 20.08.00 allows local privilege esc…7.8
• CVE-2020-35594Zoho ManageEngine ADManager Plus before 7066 allows XSS.6.1