CVE-2026-118057 paultgoodchild CVE debrief

Who should care

Defenders responsible for WordPress installations using the Shield Security plugin, especially those with version 22.3.2 or earlier, should assess exposure and prioritize verifying and mitigating the vulnerability.

Why it matters

The Shield Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting, allowing unauthenticated attackers to inject arbitrary web scripts. Defenders should prioritize verifying exposure and applying security patches.

• Unauthenticated attackers can inject arbitrary web scripts, potentially leading to malicious code execution.
• The vulnerability can be exploited through the 'REQUEST_URI' parameter, allowing attackers to inject scripts in pages that will execute when accessed by users.
• The issue requires verification of WordPress installations using the Shield Security plugin and application of security patches.

Technical summary

The Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI' parameter in all versions up to, and including, 22.3.2. This is due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Defensive priority

Defenders should prioritize verifying exposure of WordPress installations using the Shield Security plugin, especially those with version 22.3.2 or earlier, and assess the risk of stored cross-site scripting attacks.

Recommended defensive actions

• Verify WordPress installations using the Shield Security plugin, especially those with version 22.3.2 or earlier, to assess exposure.
• Apply the latest security patches for the Shield Security plugin.
• Implement additional security measures, such as Content Security Policy (CSP), to mitigate cross-site scripting attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability exists in the Shield Security plugin for WordPress, specifically in the handling of the 'REQUEST_URI' parameter. The plugin's insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. The issue is exacerbated by the 'path' column in ForTraffic.php being rendered using innerHTML, which parses stored HTML into live DOM nodes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.