CVE-2021-25101

Published: Feb 21, 2022Modified: Jun 17, 2026

4.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: NVD

Description

The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a Reflected Cross-Site scripting. Due to the presence of specific parameter value, available to admin users, this can only be exploited by an admin against another admin user.

Affected (1)

Products: Anti Malware Security And Brute Force Firewall Project: Anti Malware Security And Brute Force Firewall

Anti Malware Security And Brute Force Firewall Project

1 product

Anti Malware Security And Brute Force Firewall

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Anti Malware Security And Brute Force Firewall Project Anti Malware Security And Brute Force Firewall	Before 4.20.94

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://wpscan.com/vulnerability/5fd0380c-0d1d-4380-96f0-a07be5a61eba

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/5fd0380c-0d1d-4380-96f0-a07be5a61eba

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.