Vulnerability Description
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a Reflected Cross-Site scripting. Due to the presence of specific parameter value, available to admin users, this can only be exploited by an admin against another admin user.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Anti-Malware Security And Brute-Force Firewall Project | Anti-Malware Security And Brute-Force Firewall | < 4.20.94 |
Related Weaknesses (CWE)
References
- https://wpscan.com/vulnerability/5fd0380c-0d1d-4380-96f0-a07be5a61ebaExploitThird Party Advisory
- https://wpscan.com/vulnerability/5fd0380c-0d1d-4380-96f0-a07be5a61ebaExploitThird Party Advisory
FAQ
What is CVE-2021-25101?
CVE-2021-25101 is a vulnerability with a CVSS score of 4.8 (MEDIUM). The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a Ref...
How severe is CVE-2021-25101?
CVE-2021-25101 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-25101?
Check the references section above for vendor advisories and patch information. Affected products include: Anti-Malware Security And Brute-Force Firewall Project Anti-Malware Security And Brute-Force Firewall.