CVE-2022-0953

Published: Apr 25, 2022Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.96 does not sanitise and escape the QUERY_STRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters

Affected (1)

Products: Download Anti Malware Security And Brute Force Firewall Project: Download Anti Malware Security And Brute Force Firewall

Download Anti Malware Security And Brute Force Firewall Project

1 product

Download Anti Malware Security And Brute Force Firewall

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Download Anti Malware Security And Brute Force Firewall Project Download Anti Malware Security And Brute Force Firewall	Before 4.20.96

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://wpscan.com/vulnerability/29ab3c7b-58e0-4a72-b7b4-ab12a6d54f5a

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/29ab3c7b-58e0-4a72-b7b4-ab12a6d54f5a

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.