Shield Security CVE-2026-118057

Injection requires the plugin's traffic/activity logging to be enabled so that REQUEST_URI is captured and persisted - with logging active, the injection itself needs no authentication and no further special configuration. Execution of the stored payload requires an authenticated administrator to subsequently open the plugin's Traffic log viewer page, where the hidden 'path' column is constructed by DataTables via innerHTML because ForTraffic.php lacks a client-side render function; the partial fix in 18.5.8 added esc_html() only to the visible 'page' column, leaving 'path' exploitable through 22.3.2. Limiting factors: traffic logging must be on, an admin must view the traffic table, and the site must run an affected version (≤22.3.2; fixed in 22.3.4 per the vendor changeset).

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) frames this as a network-reachable, low-complexity, unauthenticated stored XSS with scope change and limited confidentiality/integrity impact. The injection step is genuinely trivial: any unauthenticated attacker can place a payload into the stored traffic log simply by sending a request whose REQUEST_URI contains script. However, the description establishes a real limiting factor that the CVSS UI:N metric understates - the payload only executes when the plugin's traffic logging is active AND an authenticated administrator later opens the Traffic log viewer, where the hidden 'path' column is rendered through DataTables' innerHTML. This makes realistic exploitation opportunistic rather than guaranteed. On the decision signals: the input carries no EPSS score and no CISA KEV listing, so there is no evidence of active or widespread exploitation; the vuln.today Decision label is 'this_week' (elevated, not emergency). No public exploit or PoC reference is present in the input (only the Wordfence advisory and vendor source-code links). Net assessment: a credible, easily-triggered injection whose impact is gated on admin viewing behavior - a legitimate patch-this-week item, not a drop-everything emergency, and not merely a high-CVSS/low-real-risk issue given the unauthenticated injection and admin-session impact. EPSS is absent and should be checked to refine prioritization.

An unauthenticated attacker sends an HTTP request to the WordPress site whose URL path contains a JavaScript payload; the Shield Security traffic logger records the REQUEST_URI and stores it. Later, when a site administrator opens the plugin's Traffic log viewer, the hidden 'path' column is built via DataTables innerHTML with no escaping, so the stored HTML is parsed into live DOM nodes and the script runs in the administrator's authenticated browser session. No public exploit code is identified in the provided data.