TI-2023-00939 Aliases CVE-2023-0992 GHSA-2p6c-99qx-rqfx

Shield Security <= 17.0.17 - Unauthenticated Stored Cross-Site Scripting

HIGH 81CWE-79Published 2023-06-09 · Updated 2026-04-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The Shield Security plugin for WordPress is vulnerable to stored Cross-Site Scripting in versions up to, and including, 17.0.17 via the 'User-Agent' header. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.93046 99th percentileScored 2026-11-07

Fix Fixed Shield: Blocks Bots, Protects Users, and Prevents Security Breaches (paultgoodchild): 17.0.18

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
paultgoodchild	Shield: Blocks Bots, Protects Users, and Prevents Security Breaches	before 17.0.18	17.0.18	Patch available	CNA

Shield: Blocks Bots, Protects Users, and Prevents Security Breaches Vendorpaultgoodchild Affected before 17.0.18 Fixed in 17.0.18 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:getshieldsecurity:shield_security::::::wordpress::*	up to 17.0.17	Vulnerable	Getshieldsecurity

cpe:2.3:a:getshieldsecurity:shield_security:*:*:*:*:*:wordpress:*:* Versions up to 17.0.17 Vulnerable ·Getshieldsecurity

Remediation

Fix · CNA Shield: Blocks Bots, Protects Users, and Prevents Security Breaches (paultgoodchild) Fixed in 17.0.18

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2023-06-09
paultgoodchild Shield: Blocks Bots, Protects Users, and Prevents Security Breaches 17.0.18
2 records Highest priority Priority HIGH 1 HIGH, 1 LOW
Other records, highest priority first
- TI-2023-00940 Shield Security <= 17.0.17 - Missing AuthorizationPriority LOW 21
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2023-0992
2026-10-03 Alias added: GHSA-2p6c-99qx-rqfx

References

Patch 1

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2883864%40wp-simple-firewall%2Ftrunk&old=2883536%40wp-simple-firewall%2Ftrunk&sfp_email=&sfph_mail=

Advisory 1

https://www.wordfence.com/threat-intel/vulnerabilities/id/162dff28-94ea-4a47-a6cb-a13317cf1a04?source=cve

Other 2

TI-2026-83515 Stored cross-site scripting in Shield Security via request path CVSS 3.1HIGH 7.2
TI-2026-00509 Shield Security <= 21.0.8 - Cross-Site Request Forgery to SQL Injection CVSS 3.1MEDIUM 6.5
TI-2026-00363 Shield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter CVSS 3.1MEDIUM 6.1
TI-2025-14019 Shield Security <= 21.0.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator CVSS 3.1MEDIUM 4.3
TI-2025-13178 Missing authorization in paultgoodchild Shield: Blocks Bots, Protects Users, and Prevents… CVSS 3.1MEDIUM 4.3
TI-2024-04046 Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 19.1.13 - Cross-Site Request Forgery CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences