CVE-2026-57691
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Anti-Malware Security and Brute-Force Firewall (gotmls) plugin contains a reflected XSS vulnerability due to improper input neutralization during page generation. The issue affects versions up to and including 4.23.89.
Risk Assessment
An attacker can inject a malicious script into the server response, enabling session theft, redirection to malicious sites, or other actions in the victim's browser context.
Recommendation
Immediately update the Anti-Malware Security and Brute-Force Firewall plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Anti-Malware Security and Brute-Force Firewall
See all- CVE-2026-39478High
Versions of Anti-Malware Security and Brute-Force Firewall up to 4.23.87 are vulnerable to PHP Object Injection by attackers.
- CVE-2025-11705Medium
The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to and including 4.23.81 due to a missing capability check combined with information exposure in several GOTMLS_* AJAX actions. An authenticated attacker with Subscriber-level access and above can read arbitrary files on the server.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eli Anti-Malware Security and Brute-Force Firewall gotmls allows Reflected XSS.This issue affects Anti-Malware Security and Brute-Force Firewall: from n/a through <= 4.23.89.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS