shield_security 漏洞

中危CVE-2024-73132024/07/30

Shield Security Plugin < 20.0.6 - Cross-Site Scripting

The Shield Security WordPress plugin before 20.0.6 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape the 'nav_sub' parameter in the admin dashboard, allowing authenticated users to execute arbitrary JavaScript in the context of other authenticated administrators.

shield_securityPoC 已收录

CVSS6.1EPSS 50.5%

严重CVE-2023-69892024/02/05

Shield Security WP Plugin <= 18.5.9 - Local File Inclusion

The Shield Security Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the render_action_template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.

shield_securityPoC 已收录RCE

CVSS9.8EPSS 73.0%

shield_security

关联漏洞

Shield Security Plugin < 20.0.6 - Cross-Site Scripting

Shield Security WP Plugin <= 18.5.9 - Local File Inclusion