title: All In One WP Security < 4.4.11 - Authenticated Reflected Cross-Site Scripting
description: The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirect_to parameter before using it to redirect user, either via a Location header, or meta url attribute, when the Rename Login Page is active, which could lead to an Arbitrary Redirect as well as Cross-Site Scripting issue. Exploitation of this issue requires the Login Page URL value to be known, which should be hard to guess, reducing the risk
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: All In One WP Security & Firewall
vendor: Unknown
versions:
lessThan: 4.4.11, status: affected, version: 4.4.11, versionType: custom
}