CVE-2021-25101: The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a ...

Summary

The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a Reflected Cross-Site scripting. Due to the presence of specific parameter value, available to admin use...

What to do

Update anti-malware_security_and_brute-force_firewall_project anti-malware_security_and_brute-force_firewall to version 4.20.94 or later.

Affected software

Vendor	Product	Affected versions
anti-malware_security_and_brute-force_firewall_project	anti-malware_security_and_brute-force_firewall	< 4.20.94 `cpe:2.3:a:anti-malware_security_and_brute-force_firewall_project:anti-malware_security_and_brute-force_firewall::::::wordpress::*`

Original advisory text

The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a ...

The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a Reflected Cross-Site scripting. Due to the presence of specific parameter value, available to admin users, this can only be exploited by an admin against another admin user.

References

https://wpscan.com/vulnerability/5fd0380c-0d1d-4380-96f0-a07be5a61eba Exploit Third Party Advisory