PLUGIN SECURITY
Is Limit Login Attempts Reloaded safe?
WordPress login security with brute force protection, Two-factor authentication (2FA/MFA), firewall, IP/country blocking, and login monitoring
What this plugin does
- Slug:
limit-login-attempts-reloaded - Author: WPChef
- 1000000+ active installs
- 96/100 rating (1477 reviews on wordpress.org)
- 93140505 all-time downloads
- On WordPress.org since 2016-08-03
2FABrute Forcefirewalllogin securitysecurity
Maintenance status
- Latest known version: 3.3.4
- Last updated: 2026-08-12 2:00pm GMT
- Tested up to WordPress: 7.0.4
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
5 known CVEs on file for Limit Login Attempts Reloaded. Reported between 2020 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-18356 | Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention [limit-login-attempts-reloaded] < 3.3.5 | Incomplete List of Disallowed Inputs | Low 3.7 | < 3.3.5 | 3.3.5 | 2026-08-21 | ⚠ update needed |
| CVE-2023-6934 | Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention [limit-login-attempts-reloaded] < 2.25.27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.25.27 | 2.25.27 | 2023-12-20 | ✓ fixed in latest |
| CVE-2023-5525 | Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention [limit-login-attempts-reloaded] < 2.25.26 | Missing Authorization | Medium 4.3 | < 2.25.26 | 2.25.26 | 2023-11-06 | ✓ fixed in latest |
| — | Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention [limit-login-attempts-reloaded] < 2.16.0 | — | Unknown | < 2.16.0 | 2.16.0 | 2020-12-21 | ✓ fixed in latest |
| — | Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention [limit-login-attempts-reloaded] < 2.17.4 | — | Unknown | < 2.17.4 | 2.17.4 | 2020-12-21 | ✓ fixed in latest |
| CVE-2020-35589 | Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention [limit-login-attempts-reloaded] < 2.17.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.17.4 | 2.17.4 | 2020-12-14 | ✓ fixed in latest |
| CVE-2020-35590 | Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention [limit-login-attempts-reloaded] < 2.17.4 | Improper Restriction of Excessive Authentication Attempts | Critical 9.8 | < 2.17.4 | 2.17.4 | 2020-12-14 | ✓ fixed in latest |
How to fix it
Keep Limit Login Attempts Reloaded updated — 3.3.4 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Wordfence Security – Firewall, Malware Scan, and Login Security — 5000000+ active installs — 94/100 (4981) — max PHP 8.4
- Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) — 3000000+ active installs — 98/100 (8862) — max PHP 8.4
- Two Factor — 100000+ active installs — 96/100 (208) — max PHP 8.4
- WP 2FA – Two-factor authentication for WordPress — 100000+ active installs — 94/100 (176)
- Anti-Malware Security and Brute-Force Firewall — 100000+ active installs — 98/100 (783) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.