CVE-2022-2599

Deeper analysis

The Anti-Malware Security and Brute-Force Firewall WordPress plugin before version 4.21.83 is affected by a reflected cross-site scripting vulnerability (CWE-79). The root cause is insufficient sanitization and escaping of certain parameters that are reflected back in the administrative dashboard, allowing script execution in the context of an authenticated administrator's session. The issue carries a CVSS 3.1 score of 6.1 with a network attack vector, low complexity, no required privileges, and required user interaction.

An attacker can exploit the flaw by crafting a malicious link containing unsanitized parameters and tricking an administrator into clicking it, resulting in arbitrary script execution within the WordPress admin interface. Successful exploitation can lead to limited confidentiality and integrity impacts such as session token theft or unauthorized actions performed on behalf of the administrator, though availability is unaffected.

The referenced WPScan advisory identifies the affected plugin versions and indicates that the vulnerability is resolved in release 4.21.83 and later. Administrators are therefore advised to update the plugin to a fixed version to eliminate the reflected XSS vectors.

EPSS for this CVE reached a peak of 0.4733 after disclosure before settling at the current value of 0.3091, indicating that exploitation interest increased measurably following public release.