Two new zero-day vulnerabilities discovered in WordPress Plugin Limit Login Attempts Reloaded

Researchers identified two security bugs. One was a rate-limiting bypass under a non-default configuration, which defeats the purpose of the plugin, and the other was an unauthenticated reflected XSS.