WORDFENCE-d2137662-d328-4da7-986a-341ff1bdca63 medium

Description

The iThemes Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Affected software — plugin: Kadence Security – Password, Two Factor Authentication, and Brute Force Protection (affected: [*, 3.4.4)). CVSS 6.5 (Medium) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.

Indicators of Compromise (0)

No indicators of compromise on this threat.

References (2)

• Wordfence vulnerability detail Wordfence
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d2137662-d328-4da7-986a-341ff1bdca63?source=api-prod Wordfence

• Wordfence remediation: Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
  Wordfence

  Update to version 3.4.4, or a newer patched version

  2026-06-06 16:15 UTC

Only Available for Registered Users. Sign in to view.