WordPress All In One WP Security & Firewall Plugin < 4.4.11 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.124063";...

CVE-2021-25102

The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirectto parameter before using it to redirect user, either via a Location header, or meta url attribute, when the Rename Login Page is active, which could lead to an Arbitrary Redire...

CVE-2021-25102 All In One WP Security < 4.4.11 - Authenticated Reflected Cross-Site Scripting

The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirectto parameter before using it to redirect user, either via a Location header, or meta url attribute, when the Rename Login Page is active, which could lead to an Arbitrary Redire...

CVE-2021-25102

The CVE-2021-25102 entry concerns the WordPress plugin All In One WP Security & Firewall (pre-4.4.11). The issue is that the plugin does not validate, sanitize, or escape the redirect_to parameter when the Rename Login Page feature is active, allowing an arbitrary redirect and a potential Cross-S...