Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: Getshieldsecurity Clear all filters
TI-2024-06774 CVE-2024-7313 · GHSA-c84x-657q-q6vq

Shield Security < 20.0.6 - Reflected XSS

Priority MEDIUM 60

The Shield Security WordPress plugin before 20.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege us…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01551 Published 2024-08-26 Fixed in 20.0.6 CWE-79
TI-2023-06390 CVE-2023-6989 · GHSA-72xj-cfw6-3c4q

Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion

Priority HIGH 82

The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the render_action_template parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.56567 Published 2024-02-05 No fix listed CWE-98
TI-2024-14764 CVE-2024-22163 · GHSA-3g98-33qx-2q68

WordPress Shield Security Plugin <= 18.5.7 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shield Security Shield Security – Smart Bot Blocking & Intrusion Prevention Security allows Stored XSS.This issue affe…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00331 Published 2024-01-31 No fix listed CWE-79
TI-2023-00940 CVE-2023-0993 · GHSA-5p6w-7m52-66g9

Shield Security <= 17.0.17 - Missing Authorization

Priority LOW 21

The Shield Security plugin for WordPress is vulnerable to Missing Authorization on the 'theme-plugin-file' AJAX action in versions up to, and including, 17.0.17.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0055 Published 2023-06-09 Fixed in 17.0.18 CWE-862
TI-2022-00148 CVE-2022-0211 · GHSA-5chx-62hx-4phc

Shield Security < 13.0.6 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2022-02-21 Fixed in 13.0.6 CWE-79