Is Anti-Malware Security and Brute-Force Firewall safe?

Every recorded flaw

• Jul 13, 2026Anti-Malware Security and Brute-Force Firewall: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57691 · affects up to 4.23.89 · reported by PatchstackMedium 5.8
• Jun 15, 2026Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions.CVE-2026-39478 · affects up to 4.23.87 · reported by PatchstackHigh 8.8
• Oct 29, 2025Anti-Malware Security and Brute-Force Firewall: Arbitrary File ReadCVE-2025-11705 · affects up to 4.23.81 · reported by WordfenceMedium 6.5
• Apr 25, 2024Anti-Malware Security and Brute-Force Firewall: Improper Control of Generation of Code ('Code Injection')CVE-2024-22144 · affects up to 4.21.96 · reported by PatchstackCritical 9
• Aug 29, 2022Anti-Malware Security and Brute-Force Firewall: Does not sanitise and escape some parameters before outputting them back in an admin dashboardCVE-2022-2599 · fixed in 4.21.83 · reported by WPScan1.4% oddsMedium 6.1
• Apr 25, 2022Anti-Malware Security and Brute-Force Firewall: Does not sanitise and escape the QUERY_STRING before outputting it back in an admin pageCVE-2022-0953 · fixed in 4.20.96 · reported by WPScan3.1% oddsMedium 6.1
• Feb 21, 2022Anti-Malware Security and Brute-Force Firewall: Does not sanitise and escape the POST data before outputting it back in attributes of an admin pageCVE-2021-25101 · fixed in 4.20.94 · reported by WPScanMedium 4.8

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.