Threat Entry Updated 2025-10-30

CVE-2025-11705 - Anti Malware Security And Brute Force Firewall Plugin

The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.23.81 due to a missing capability check combined with an information exposure in several GOTMLS_* AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

PLUGIN Anti Malware Security And Brute Force Firewall

CVE-2025-11705

MEDIUM CVSS 6.5 2025-10-29

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2022-2599 - Anti Malware Security And Brute Force Firewall Plugin

The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.21.83 does not sanitise and escape some parameters before outputting them back in an admin dashboard, leading to Reflected Cross-Site Scripting

PLUGIN Anti Malware Security And Brute Force Firewall

CVE-2022-2599

MEDIUM CVSS 6.1 2022-08-29

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2022-0953 - Anti Malware Security And Brute Force Firewall Plugin

The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.96 does not sanitise and escape the QUERY_STRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters

PLUGIN Anti Malware Security And Brute Force Firewall

CVE-2022-0953

MEDIUM CVSS 6.1 2022-04-25

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-25101 - Anti Malware Security And Brute Force Firewall Plugin

The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a Reflected Cross-Site scripting. Due to the presence of specific parameter value, available to admin users, this can only be exploited by an admin against another admin user.

PLUGIN Anti Malware Security And Brute Force Firewall

CVE-2021-25101

MEDIUM CVSS 4.8 2022-02-21

Risk Score

Open Full Technical Breakdown