WordPress Plugin Vulnerabilities

WPS Limit Login < 1.5.9.4 - Unauthenticated Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
wps-limit-login
Fixed in 1.5.9.4

References

CVE
CVE-2026-93622
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/e5a051d6-d37d-450d-9920-38158f75435b

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
d4ad01ee-e09e-48af-838c-eca3fb4a43da

Timeline

Publicly Published
2026-09-23 (about 24 days ago)
Added
2026-09-30 (about 17 days ago)
Last Updated
2026-10-16 (about 10 hours ago)

Other

Published
Title
Published
2025-08-06
Title
Post Connector <= 1.0.11 - Reflected Cross-Site Scripting
Published
2022-07-04
Title
Name Directory < 1.25.3 - Reflected Cross-Site Scripting
Published
2025-06-19
Title
CSV Importer Improved <= 0.6.1 - Authenticated (Editor+) Stored Cross-Site Scripting
Published
2024-11-08
Title
Charity Addon for Elementor < 1.3.3 - Contributor+ Stored XSS
Published
2022-05-09
Title
Slideshow <= 2.3.1 - Author+ Stored Cross-Site Scripting