The WP Hardening – Fix Your WordPress Security plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 1.2.6.
The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the historyvalue GET parameter before outputting it in a Javascript block, leading to a reflected Cross-Site Scripti…
CVSS 3.1MEDIUM 6.1·Network·No auth·User interaction·EPSS 0.00827·Published 2021-06-21·Fixed in 1.2.2CWE-79
The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the $_SERVER['REQUEST_URI'] before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue.
CVSS 3.1MEDIUM 6.1·Network·No auth·User interaction·EPSS 0.00827·Published 2021-06-21·Fixed in 1.2.2CWE-79