CVE-2023-4549

The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form.

Score

CVSS 3.1 6.1 Medium

Status

Analyzed - contact@wpscan.com

Published

2023-09-25

Last modified

2024-08-02

Weaknesses

CWE-79

Affected products

• Dologin Security (Unknown)
• Dologin Security (Wpdo)

References

• https://wpscan.com/vulnerability/8aebead0-0eab-4d4e-8ceb-8fea0760374f