WordPress plugin
Anti-Malware Security and Brute-Force Firewall security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 11 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High4
- Medium5
- Low1
All Anti-Malware Security and Brute-Force Firewall vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤4.23.89Update to 4.23.90 | CVE-2026-57691 | |
| High7.5 | Authenticated (Contributor+) PHP Object Injection ≤4.23.87Update to 4.23.88 | CVE-2026-39478 | |
| Medium6.5 | Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read ≤4.23.81Update to 4.23.83 | CVE-2025-11705 | |
| Critical9.0 | Unauthenticated Remote Code Execution ≤4.21.96Update to 4.23.56 | CVE-2024-22144 | |
| High7.2 | Authenticated (Admin+) PHP Object Injection ≤4.21.85Update to 4.21.86 | CVE-2022-4327 | |
| Medium6.1 | Reflected Cross-Site Scripting <4.20.96Update to 4.20.96 | CVE-2022-0953 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤4.21.74Update to 4.21.83 | CVE-2022-2599 | |
| Medium6.1 | Reflected Cross-Site Scripting <4.20.94Update to 4.20.94 | CVE-2021-25101 | |
| High7.2 | Cross-Site Scripting ≤4.15.17Update to 4.16.18 | — | |
| Medium6.1 | Cross-Site Scripting <4.15.23Update to 4.15.23 | — | |
| Low3.1 | Cross-Site Request Forgery <4.15.23Update to 4.15.23 | — |
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.23.89Update to 4.23.90
- High7.5Authenticated (Contributor+) PHP Object Injection
≤4.23.87Update to 4.23.88
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read
≤4.23.81Update to 4.23.83
- Critical9.0Unauthenticated Remote Code Execution
≤4.21.96Update to 4.23.56
- High7.2Authenticated (Admin+) PHP Object Injection
≤4.21.85Update to 4.21.86
- Medium6.1Reflected Cross-Site Scripting
<4.20.96Update to 4.20.96
- Medium6.1Reflected Cross-Site Scripting
≤4.21.74Update to 4.21.83
- Medium6.1Reflected Cross-Site Scripting
<4.20.94Update to 4.20.94
- High7.2Cross-Site Scripting
≤4.15.17Update to 4.16.18
- Medium6.1Cross-Site Scripting
<4.15.23Update to 4.15.23
- Low3.1Cross-Site Request Forgery
<4.15.23Update to 4.15.23
Anti-Malware Security and Brute-Force Firewall: common questions
Does Anti-Malware Security and Brute-Force Firewall have known vulnerabilities?
Yes. VulnCrest Radar lists 11 known vulnerabilities in Anti-Malware Security and Brute-Force Firewall: 1 critical, 4 high, 5 medium, 1 low. None are known to affect version null.
How do I check which version of Anti-Malware Security and Brute-Force Firewall I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Anti-Malware Security and Brute-Force Firewall vulnerability?
CVE-2026-57691, published Jul 9, 2026: Anti-Malware Security and Brute-Force Firewall <= 4.23.89 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any Anti-Malware Security and Brute-Force Firewall vulnerability listed in CISA KEV?
No. None of the known Anti-Malware Security and Brute-Force Firewall vulnerabilities is currently listed in the CISA KEV catalog.