Shield Security WordPress Plugin: Stored Cross-Site Scripting (CVE-2026-118057)
The Shield Security - Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress contains a Stored Cross-Site Scripting vulnerability via the 'REQUEST_URI' parameter in versions up to and including 22.3.2.
CVE search metadata
CVE search record: CVE-2026-118057. Severity: high. CVSS: 7.2. KEV: no. Product: Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning (<= 22.3.2). Brief: Shield Security WordPress Plugin: Stored Cross-Site Scripting (CVE-2026-118057). Brief link: https://feed.craftedsignal.io/briefs/2026-10-shield-security-xss/
Triage facts
Revision 1- Applicability
- Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning (<= 22.3.2)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 31, 11:57 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Shield Security - Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI' parameter in all versions up to, and including, 22.3.2. This is due to insufficient input sanitization and output escaping.
The hidden 'path' column in ForTraffic.php lacks a client-side render function, causing DataTables to build its cell via innerHTML. This results in stored HTML in the path value being parsed into live DOM nodes. A prior partial fix in version 18.5.8 added esc_html() to the visible 'page' column, but left the hidden 'path' field unescaped and exploitable through version 22.2.6. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.