WordPress CVEs

Description

The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.21.83 does not sanitise and escape some parameters before outputting them back in an admin dashboard, leading to Reflected Cross-Site Scripting

Affected WordPress components

• Anti-Malware Security and Brute-Force Firewall Plugin · gotmls
  Confirmed match Active
  From 4.21.83 (including) to 4.21.83 (excluding)
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• Unknown Anti-Malware Security and Brute-Force Firewall — From 4.21.83 (including) to 4.21.83 (excluding)
• anti-malware_security_and_brute-force_firewall_project anti-malware_security_and_brute-force_firewall — Before 4.21.83

References

• wpscan.com https://wpscan.com/vulnerability/276a7fc5-3d0d-446d-92cf-20060aecd0ef Exploit, Third Party Advisory
• nvd.nist.gov Official NVD record