Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning (<= 22.3.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/shield-security--smart-bot-blocking-brute-force-login-protection--file-scanning--22.3.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 11:57:24 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgShield Security WordPress Plugin: Stored Cross-Site Scripting (CVE-2026-118057)https://feed.craftedsignal.io/briefs/2026-10-shield-security-xss/Sat, 31 Oct 2026 11:57:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-shield-security-xss/The Shield Security - Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress contains a Stored Cross-Site Scripting vulnerability via the 'REQUEST_URI' parameter in versions up to and including 22.3.2.The Shield Security - Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI' parameter in all versions up to, and including, 22.3.2. This is due to insufficient input sanitization and output escaping.

The hidden 'path' column in ForTraffic.php lacks a client-side render function, causing DataTables to build its cell via innerHTML. This results in stored HTML in the path value being parsed into live DOM nodes. A prior partial fix in version 18.5.8 added esc_html() to the visible 'page' column, but left the hidden 'path' field unescaped and exploitable through version 22.2.6. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

]]>highadvisory