CVE-2020-35589: 
WordPress vulnerability analysis and mitigation

The Limit Login Attempts Reloaded plugin before version 2.17.4 for WordPress contains a Cross-Site Scripting (XSS) vulnerability identified as CVE-2020-35589. The vulnerability was discovered on December 14, 2020, and affects the plugin's options page in the WordPress admin interface. This security flaw impacts WordPress installations with the affected plugin versions, specifically targeting administrator users who have access to the plugin's configuration page (N4nj0 Advisory, WPScan).

The vulnerability exists in the wp-admin/options-general.php page, specifically in the 'tab' parameter. The plugin fails to properly sanitize user input in its options page, allowing for reflected XSS attacks. The CVSS v3.1 score for this vulnerability is 5.4 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

When exploited, this vulnerability allows attackers to execute arbitrary web scripts or HTML in the context of the administrator's browser session. This could lead to various attacks including cookie theft (if HttpOnly flag is missing from session cookies), web page modification, clipboard content capture, keylogging, and other malicious activities. The impact is limited to WordPress administrators who have access to the plugin's configuration page (N4nj0 Advisory).

The vulnerability requires user interaction and can be exploited by causing an administrator to supply dangerous content to the vulnerable page. The most common attack vector is including malicious content as a parameter in a URL that is posted publicly or emailed directly to victims. A proof of concept exploit involves accessing the URL: http://wordpress/wp-admin/options-general.php?page=limit-login-attempts&tab=d7raf">alert(1) (N4nj0 Advisory).

The vulnerability has been fully remediated in version 2.17.4 of the Limit Login Attempts Reloaded plugin. Site administrators should update to this version or later to protect against this security issue. The issue was partially fixed in version 2.15.1 and fully addressed in version 2.16.0 (WPScan).