# Anti-Malware Security and Brute-Force Firewall <= 4.23.90 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Firewall Definitions

- **ID:** WPSEC-2026-1631
- **Plugin:** Anti-Malware Security and Brute-Force Firewall (`gotmls`), https://wordpress.org/plugins/gotmls/
- **Affected versions:** all versions before 4.23.91
- **Fixed in:** 4.23.91 (Update to 4.23.91 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-352
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/gotmls
- **Fix released:** 2026-10-24
- **Published:** 2026-10-25
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1631/

## Description

The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting via the definitions update and Firewall Options page in all versions up to, and including, 4.23.90. This is due to two causes. Nonce tokens were not strictly bound to their owner: a loose comparison let a token issued to an unauthenticated visitor's spoofable IP address validate for a logged-in administrator. Firewall definition keys and descriptions were also output into HTML and an onclick JavaScript context without escaping. This makes it possible for unauthenticated attackers to replace the plugin's definitions and inject arbitrary web scripts that execute in an administrator's browser, if they can trick an administrator into performing an action such as clicking a link.

## References

- https://wpsec.com/vuln/WPSEC-2026-1631/
- https://plugins.svn.wordpress.org/gotmls/tags/4.23.91/
- https://wordpress.org/plugins/gotmls/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1631/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.