ET WEB_SPECIFIC_APPS WordPress Limit Login Attempts Plugin Stored Cross Site Scripting (CVE-2023-1861)

Query · suricata

flow:established,to_server;
http.method;
content:"GET";
http.uri;
content:"/wp-";
pcre:"/^(?:admin|login)/R";
http.cookie;
content:"wordpress_"; fast_pattern;
content:"|3d|"; distance:0;
pcre:"/^.+(script|onmouse[a-z]+|onkey[a-z]+|onerror|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3d)/Ri";
Raw source ET WEB_SPECIFIC_APPS WordPress Limit Login Attempts Plugin Stored Cross Site Scripting (CVE-2023-1861) · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert http any any -> $HOME_NET any (
    msg:"ET WEB_SPECIFIC_APPS WordPress Limit Login Attempts Plugin Stored Cross Site Scripting (CVE-2023-1861)";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.uri;
    content:"/wp-";
    pcre:"/^(?:admin|login)/R";
    http.cookie;
    content:"wordpress_"; fast_pattern;
    content:"|3d|"; distance:0;
    pcre:"/^.+(script|onmouse[a-z]+|onkey[a-z]+|onerror|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3d)/Ri";
    reference:url,wpscan.com/vulnerability/461cbcca-aed7-4c92-ba35-ebabf4fcd810/;
    reference:cve,2023-1861;
    classtype:web-application-attack;
    sid:2059302; rev:1;
    metadata:created_at 2025_01_17, cve CVE_2023_1861, performance_impact Low, signature_severity Unknown, updated_at 2025_01_17;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.