Mohammadreza Rashidi

The issue arises from insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the `X-Forwarded-For` header with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in.

The WordPress Visitors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a spoofed HTTP Header value due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the nm vistior page.

The issue arises from insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. This allows attackers to supply the `X-Forwarded-For` header with a different IP Address that will be logged, potentially bypassing settings that block specific IP addresses or countries from logging in.

The issue is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the `X-Forwarded-For` header with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address from logging in.

The issue is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the `X-Forwarded-For` header with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in.

The issue arises from insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can exploit this by supplying the `X-Forwarded-For` header with a different IP Address, which will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in.

The issue is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the `X-Forwarded-For` header with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address from logging in.

The issue is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the `X-Forwarded-For` header with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address from logging in.