PLUGIN SECURITY
Is Limit Login Attempts Reloaded safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the Limit Login Attempts Reloaded WordPress plugin — checked against WP Clinic's local security database.
Plugin details
- Slug:
limit-login-attempts-reloaded - Max supported PHP (analyzed): 8.4
Known vulnerabilities
- Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention [limit-login-attempts-reloaded] < 2.17.4 [CVE-2020-35589, Limit Login Attempts Reloaded <= 2.15.2 - Reflected Cross-Site Scripting, Limit Login Attempts Reloaded < 2.16.0 - Authenticated Reflected Cross-Site Scripting]
- Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention [limit-login-attempts-reloaded] < 2.17.4 [CVE-2020-35590, Limit Login Attempts Reloaded <= 2.17.3 - Login Rate Limiting Bypass, Limit Login Attempts Reloaded < 2.17.4 - Login Rate Limiting Bypass]
- Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention [limit-login-attempts-reloaded] < 2.16.0 [WordPress Limit Login Attempts Reloaded plugin <= 2.15.2 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability]
- Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention [limit-login-attempts-reloaded] < 2.17.4 [WordPress Limit Login Attempts Reloaded plugin <= 2.17.3 - Login Rate Limiting Bypass vulnerability]
- Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention [limit-login-attempts-reloaded] < 2.25.26 [CVE-2023-5525, Limit Login Attempts Reloaded <= 2.25.25 - Missing Authorization, Limit Login Attempts Reloaded < 2.25.26 - Admin+ Missing Authorization to Toggle Plugin Auto-Update]
+ 1 more known vulnerability
- Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention [limit-login-attempts-reloaded] < 2.25.27 [CVE-2023-6934, Limit Login Attempts Reloaded <= 2.25.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode, WordPress Limit Login Attempts Reloaded Plugin <= 2.25.26 is vulnerable to Cross Site Scripting (XSS), Limit Login Attempts Reloaded < 2.25.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode]
Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.
Safer / more established alternatives
- Wordfence Security – Firewall, Malware Scan, and Login Security — 5000000+ active installs — max PHP 8.4
- Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) — 3000000+ active installs — max PHP 8.4
- Two Factor — 100000+ active installs — max PHP 8.4
- WP 2FA – Two-factor authentication for WordPress — 100000+ active installs
- Anti-Malware Security and Brute-Force Firewall — 100000+ active installs
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.