All In One Wp Security & Firewall

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:all_in_one_wp_security_&_firewall:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorUnknown (668ca391-a6cc-5e33-879b-83885214de33)
ProductAll In One Wp Security & Firewall (998bfd3f-3a46-562e-a463-0c775276d4eb)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2021-25102 vulnerable 2026-06-08 05:30:39.964076 All In One WP Security < 4.4.11 - Authenticated Reflected Cross-Site Scripting
The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirect_to parameter before using it to redirect user, either via a Location header, or meta url attribute, when the Rename Login Page is active, which could lead to an Arbitrary Redirect as well as Cross-Site Scripting issue. Exploitation of this issue requires the Login Page URL value to be known, which should be hard to guess, reducing the risk
Published: 2022-05-02T16:05:32.000Z
Updated: 2024-08-03T19:56:10.670Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.