CVE-2026-57691

MediumCVSS 5.8

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

The Anti-Malware Security and Brute-Force Firewall (gotmls) plugin contains a reflected XSS vulnerability due to improper input neutralization during page generation. The issue affects versions up to and including 4.23.89.

Risk Assessment

An attacker can inject a malicious script into the server response, enabling session theft, redirection to malicious sites, or other actions in the victim's browser context.

Recommendation

Immediately update the Anti-Malware Security and Brute-Force Firewall plugin to the latest available version that fixes this vulnerability.

Other vulnerabilities in Anti-Malware Security and Brute-Force Firewall

CVE-2026-39478High
Versions of Anti-Malware Security and Brute-Force Firewall up to 4.23.87 are vulnerable to PHP Object Injection by attackers.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eli Anti-Malware Security and Brute-Force Firewall gotmls allows Reflected XSS.This issue affects Anti-Malware Security and Brute-Force Firewall: from n/a through <= 4.23.89.