PatchTheCVECVE-2022-1029: The Limit Login Attempts WordPress plugin before 4.0.72 does not sanitise and escape some of its settings, lea
CVE-2022-1029 is a medium-severity flaw (CVSS 4.8) affecting limit login attempts. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Limit Login Attempts WordPress plugin before 4.0.72 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.8 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | Required |
| EPSS exploit chance | 0.9% (top 41%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2022-06-27 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Nuclei scan template: Limit Login Attempts - Stored Cross-Site Scripting
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-1029?
limit login attempts: upgrade to 4.0.72. Exact commands for each OS are on this page.
Is CVE-2022-1029 being exploited?
CVE-2022-1029 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-1029 affect?
CVE-2022-1029 affects limit login attempts. Severity is medium (CVSS 4.8). The Limit Login Attempts WordPress plugin before 4.0.72 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks w
How urgent is CVE-2022-1029?
Priority 37/100. Public exploit reference
Software pages
Related CVEs
- CVE-2023-1912 HIGH 7.2 UPGRADE The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock loggin
- CVE-2023-1861 MEDIUM 5.4 UPGRADE The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting