Multiple vulnerabilities have been reported in the various Plugins for WordPress which allows a remote attacker to conduct Cross Site Scripting (XSS) attacks.
This vulnerability exists due to improper validation of user-supplied input via whoisval parameter on the WordfenceWhois page to wp-admin/admin.php. A remote attacker could exploit this vulnerability by enticing the user to visit the specially crafted URL to execute arbitrary HTML and script code in victims browser in context of the vulnerable website. Successful exploitation of the vulnerability could allow an attacker to steal sensitive information and gain complete access over the web application.
This vulnerability exists due to improper validation of user-supplied input via unspecified vectors which could allow an attacker to execute arbitrary HTML and script code in victims browser in context of the vulnerable website. Successful exploitation could lead to unauthorized access and modifications on the targeted system.