Plugin icon

Shield: Blocks Bots, Protects Users, and Prevents Security Breaches

wp-simple-firewall

Vulnerabilities:

11

Last Updated:

March 5, 2026

Active Installs:

40000

Published
Title
Fixed in
CVSS
Published
2026-02-18
Title
Shield Security < 21.0.10 - Cross-Site Request Forgery to SQL Injection
Fixed in
Fixed in 21.0.10
CVSS
6.5 (medium)
Published
2026-02-18
Title
Shield Security < 21.0.10 - Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter
Fixed in
Fixed in 21.0.10
CVSS
6.1 (medium)
Published
2026-02-18
Title
Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches < 21.0.10 - Missing Authorization to Authenticated (Subscriber+) Email MFA Update
Fixed in
Fixed in 21.0.10
CVSS
4.3 (medium)
Published
2026-01-15
Title
Shield Security < 21.0.10 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator
Fixed in
Fixed in 21.0.10
CVSS
4.3 (medium)
Published
2024-08-05
Title
Shield Security < 20.0.6 - Reflected XSS
Fixed in
Fixed in 20.0.6
CVSS
7.1 (high)
Published
2024-06-01
Title
Shield Security – Smart Bot Blocking & Intrusion Prevention Security < 19.1.11 - Cross-Site Request Forgery
Fixed in
Fixed in 19.1.11
CVSS
4.3 (medium)
Published
2024-02-05
Title
Shield Security – Smart Bot Blocking & Intrusion Prevention Security < 18.5.10 - Unauthenticated Local File Inclusion
Fixed in
Fixed in 18.5.10
CVSS
9.8 (critical)
Published
2024-01-16
Title
Shield Security < 18.5.8 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 18.5.8
CVSS
7.2 (high)
Published
2023-04-25
Title
Shield Security < 17.0.18 - Subscriber+ Arbitrary Log Entry Creation
Fixed in
Fixed in 17.0.18
CVSS
4.3 (medium)
Published
2023-04-25
Title
Shield Security < 17.0.18 - Unauthenticated Stored XSS
Fixed in
Fixed in 17.0.18
CVSS
8.8 (high)
Published
2022-01-19
Title
Shield Security < 13.0.6 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 13.0.6
CVSS
3.4 (low)