Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: WPDO Component: Dologin Security Clear all filters
TI-2023-04417 CVE-2023-4800 · GHSA-8ch2-m9x4-vgjv

DoLogin Security < 3.7.1 - Subscriber+ IP Address leak

Priority MEDIUM 62

The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01012 Published 2023-10-16 Fixed in 3.7.1
TI-2023-04195 CVE-2023-4549 · GHSA-897r-hcfg-v9vh

DoLogin Security < 3.7 - Unauthenticated Stored Cross-Site Scripting

Priority LOW 28

The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00698 Published 2023-09-25 Fixed in 3.7 CWE-79
TI-2023-04270 CVE-2023-4631 · GHSA-5hrc-f88x-6wm7

DoLogin Security < 3.7 - IP Spoofing

Priority MEDIUM 63

The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00715 Published 2023-09-25 Fixed in 3.7