PLUGIN SECURITY
Is Limit Login Attempts safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the Limit Login Attempts WordPress plugin — checked against WP Clinic's local security database.
Plugin details
- Slug:
limit-login-attempts - Max supported PHP (analyzed): 8.4
Known vulnerabilities
- Limit Login Attempts [limit-login-attempts] < 1.7.1 (closed) [CVE-2012-10001, Limit Login Attempts <= 1.7.0 - Brute Force Bypass, Limit Login Attempts < 1.7.1 - Auth Cookies Brute Force Bypass]
- Limit Login Attempts [limit-login-attempts] < 1.7.2 (closed) [CVE-2023-1912, Limit Login Attempts <= 1.7.1 - Unauthenticated Stored Cross-Site Scripting, WordPress WP Limit Login Attempts Plugin <= 1.7.1 is vulnerable to Cross Site Scripting (XSS), WordPress Limit Login Attempts Plugin <= 1.7.1 is vulnerable to Cross Site Scripting (XSS), Limit Login Attempts < 1.7.2 - Unauthenticated Stored XSS]
- Limit Login Attempts [limit-login-attempts] < 1.7.2 (closed) [CVE-2023-1861, WordPress Limit Login Attempts Plugin <= 1.7.1 is vulnerable to Cross Site Scripting (XSS), Limit Login Attempts <= 1.7.1 - Authenticated(Subscriber+) Stored Cross-Site Scripting, Limit Login Attempts < 1.7.2 - Subscriber+ Stored XSS]
- Limit Login Attempts [limit-login-attempts] <= 1.7.2 (unfixed + closed) [CVE-2023-40666]
Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.
Safer / more established alternatives
- WPS Hide Login — 2000000+ active installs — max PHP 8.4
- Loginizer — 1000000+ active installs — max PHP <8.0
- Security Optimizer – The All-In-One Protection Plugin — 1000000+ active installs — max PHP <8.0
- LoginPress | wp-login Custom Login Page Customizer — 200000+ active installs — max PHP 8.4
- WPS Limit Login — 100000+ active installs
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.