CVE-2022-0953
Medium
Description
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.96 does not sanitise and escape the QUERY_STRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters
SeverityMedium
CVSS6.1
Exploit probability—
ProductDownload Anti-malware Security And Brute-force Firewall
PublishedApr 25, 2022
First seenApr 25, 2022
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- download_anti-malware_security_and_brute-force_firewall_project download_anti-malware_security_and_brute-force_firewall4.20.96 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| download_anti-malware_security_and_brute-force_firewall_project download_anti-malware_security_and_brute-force_firewall | v < 4.20.96 | 4.20.96 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.