Vulnerabilities > Tipsandtricks HQ > ALL IN ONE WP Security Firewall > Low

DATE	CVE	VULNERABILITY TITLE	RISK
2022-05-02	CVE-2021-25102	Cross-site Scripting vulnerability in Tipsandtricks-Hq ALL in ONE WP Security & Firewall The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirect_to parameter before using it to redirect user, either via a Location header, or meta url attribute, when the Rename Login Page is active, which could lead to an Arbitrary Redirect as well as Cross-Site Scripting issue. network high complexity tipsandtricks-hq CWE-79	2.6

CVE is a registered MITRE Corporation trademark and MITRE's CVE website is the authoritative source of CVE content. CWE is a registered MITRE Corporation trademark and MITRE's CWE website is the authoritative source of CWE content.