CVE-2021-25101

The Anti-Malware Security and Brute-Force Firewall plugin before version 4.20.94 contains a reflected cross-site scripting vulnerability where POST data is output into admin page attributes without proper sanitization or escaping. An administrator could exploit this flaw to target another administrator user by leveraging a specific parameter value accessible only to admin-level accounts.

Based on public CVE data (MITRE/NVD).