Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security

WordPress plugin · limit-login-attempts-reloaded · WordPress.org ↗

Latest v3.4.1 Last release Nov 5, 2026 Tested up to WP 7.1.4 1,000,000+ active installs

Critical

High

Known total

Unfixed

Running Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
CRITICAL CVSS 9.8	Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security [limit-login-attempts-reloaded] < 2.17.4 WPVulnerability	< 2.17.4	v2.17.4	CVE-2020-35590	Dec 14, 2020
MEDIUM CVSS 5.4	Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security [limit-login-attempts-reloaded] < 2.25.27 WPVulnerability	< 2.25.27	v2.25.27	CVE-2023-6934	Dec 20, 2023
MEDIUM CVSS 4.3	Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security [limit-login-attempts-reloaded] < 2.25.26 WPVulnerability · PoC available	< 2.25.26	v2.25.26	CVE-2023-5525	Nov 6, 2023
MEDIUM CVSS 5.4	Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security [limit-login-attempts-reloaded] < 2.17.4 WPVulnerability	< 2.17.4	v2.17.4	CVE-2020-35589	Dec 14, 2020
LOW CVSS 3.7	Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security [limit-login-attempts-reloaded] < 3.3.5 WPVulnerability	< 3.3.5	v3.3.5	CVE-2026-18356	Aug 21, 2026
UNKNOWN	Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security [limit-login-attempts-reloaded] < 2.16.0 WPVulnerability	< 2.16.0	v2.16.0	—	Dec 21, 2020
UNKNOWN	Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security [limit-login-attempts-reloaded] < 2.17.4 WPVulnerability	< 2.17.4	v2.17.4	—	Dec 21, 2020

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.