CVE-2022-2599

The Anti-Malware Security and Brute-Force Firewall plugin for WordPress contains a reflected cross-site scripting vulnerability in versions up to 4.21.74 that arises from inadequate sanitization and escaping of the 'GOTMLS_debug' parameter. An unauthenticated attacker could exploit this flaw to inject malicious scripts that would run in a victim's browser if the victim clicks a crafted link. The vulnerability was fixed in version 4.21.83.

Based on public CVE data (MITRE/NVD).