Shield Security Smart Bot Blocking Brute Force Login Protection File Scanning
Monthly
Stored cross-site scripting in the Shield Security WordPress plugin (wp-simple-firewall) affects every version up to and including 22.3.2 and lets unauthenticated remote attackers inject arbitrary HTML/JavaScript into the plugin's traffic log through the logged REQUEST_URI value. The plugin records that value without adequate sanitization and later renders it into the hidden 'path' column of the Traffic table via DataTables innerHTML, so the payload is parsed into live DOM nodes and executes when an administrator opens the Traffic log viewer. Successful abuse is bounded by two conditions: the plugin's traffic/activity logging must be enabled so REQUEST_URI is captured and persisted, and an admin must subsequently view the traffic table; the issue was only partially addressed in 18.5.8, where esc_html() was applied to the visible 'page' column but not to 'path'. Exploitation status: no public exploit identified at time of analysis, and the vendor changeset identifies 22.3.4 as the fixed release.
Stored cross-site scripting in the Shield Security WordPress plugin (wp-simple-firewall) affects every version up to and including 22.3.2 and lets unauthenticated remote attackers inject arbitrary HTML/JavaScript into the plugin's traffic log through the logged REQUEST_URI value. The plugin records that value without adequate sanitization and later renders it into the hidden 'path' column of the Traffic table via DataTables innerHTML, so the payload is parsed into live DOM nodes and executes when an administrator opens the Traffic log viewer. Successful abuse is bounded by two conditions: the plugin's traffic/activity logging must be enabled so REQUEST_URI is captured and persisted, and an admin must subsequently view the traffic table; the issue was only partially addressed in 18.5.8, where esc_html() was applied to the visible 'page' column but not to 'path'. Exploitation status: no public exploit identified at time of analysis, and the vendor changeset identifies 22.3.4 as the fixed release.