CVE-2020-35589

The limit-login-attempts-reloaded plugin versions prior to 2.17.4 contain a reflected cross-site scripting vulnerability in the wp-admin/options-general.php page within the limit-login-attempts tab parameter. An attacker can craft a malicious URL containing harmful code that, when visited by an administrator, causes the browser to execute the injected script. This type of attack typically works by tricking users into clicking links in emails or on websites that direct them to the vulnerable plugin page with the payload embedded in the URL.

Based on public CVE data (MITRE/NVD).