What is the CVSS score of CVE-2026-57691?

CVE-2026-57691 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Anti-Malware Security CVE-2026-57691

EUVD-2026-43354 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Anti Malware Security And Brute Force Firewall

5.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.8 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

4.7 MEDIUM

AV:N/AC:H/PR:N/UI:R matches reflected XSS requiring social engineering; S:C captures browser scope crossing; A:N as XSS does not cause availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:22 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eli Anti-Malware Security and Brute-Force Firewall gotmls allows Reflected XSS.This issue affects Anti-Malware Security and Brute-Force Firewall: from n/a through <= 4.23.89.

AnalysisAI

Reflected cross-site scripting in the Anti-Malware Security and Brute-Force Firewall WordPress plugin (versions through 4.23.89) enables remote unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted URL. The CVSS scope change (S:C) indicates the attack crosses security boundaries, allowing script execution in the browser context beyond the plugin itself - enabling session theft, credential harvesting, or unauthorized admin actions. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H vector component indicates exploitation requires non-trivial preconditions rather than simple mass exploitation.

Technical ContextAI

The affected component is the gotmls WordPress plugin (CPE: cpe:2.3:a:eli:anti-malware_security_and_brute-force_firewall:*:*:*:*:*:*:*:*) authored by Eli and available from the WordPress plugin repository. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the plugin fails to sanitize or encode attacker-controlled input before reflecting it into an HTTP response, allowing script injection. As a reflected XSS variant, the payload is delivered via the HTTP request (e.g., a query parameter or form field) and immediately echoed back to the victim's browser without being stored server-side. The CVSS S:C (Changed scope) metric is characteristic of browser-based XSS attacks where the injected script operates within the victim's authenticated browser session, crossing the trust boundary between the web application and the browser's same-origin security model.

RemediationAI

Site administrators should update the Anti-Malware Security and Brute-Force Firewall plugin to any version released after 4.23.89 via the WordPress admin dashboard (Plugins → Updates). The exact patched version is not confirmed in the available source data - verify that the installed version is newer than 4.23.89 after updating, and consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/gotmls/vulnerability/wordpress-anti-malware-security-and-brute-force-firewall-plugin-4-23-89-cross-site-scripting-xss-vulnerability for confirmation of the fixed release. If an update is not immediately available, a compensating control is to temporarily deactivate the plugin and substitute an alternative security plugin; this eliminates the attack surface but removes the plugin's anti-malware and brute-force protection. Additionally, deploying a web application firewall (such as Patchstack Firewall or Wordfence WAF) with XSS filtering rules can block reflected XSS payloads in transit, though WAF bypass is possible by skilled attackers and this should not substitute for patching.