WordPress Plugin Vulnerabilities

Anti-Malware Security and Brute-Force Firewall < 4.23.90 - Unauthenticated Stored Cross-Site Scripting

Description

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
gotmls
Fixed in 4.23.90

References

CVE
CVE-2026-57691
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/5e83b0ff-3628-47d7-92d0-429af92067bd

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
dutafi
Verified
No
WPVDB ID
a083f081-56a7-444e-9531-fbd9c4b1be4a

Timeline

Publicly Published
2026-07-09 (about 1 month ago)
Added
2026-07-16 (about 1 month ago)
Last Updated
2026-07-16 (about 1 month ago)

Other

Published
Title
Published
2026-07-15
Title
MxChat < 3.2.11 - Authenticated (Admin+) Stored Cross-Site Scripting via 'intro_message' Setting
Published
2025-04-11
Title
Real Testimonials < 3.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-04-14
Title
CRUDLab Scroll to Top <= 1.0.1 - Reflected Cross-Site Scripting
Published
2014-10-18
Title
Contact Form Integrated With Google Maps 1.0-2.4 - Stored Cross-Site Scripting (XSS)
Published
2025-02-21
Title
Booking Ultra Pro < 1.1.20 - Reflected Cross-Site Scripting