WordPress Plugin Vulnerabilities

Shield Security < 18.5.8 - Unauthenticated Stored Cross-Site Scripting

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the getColumnContent_Page function due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
wp-simple-firewall
Fixed in 18.5.8

References

CVE
CVE-2024-22163
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/fcd02dfa-688e-4375-92cb-8d0e7cbaaa6e

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Yudistira Arya
Verified
No
WPVDB ID
7720d56c-b69f-4fc4-9593-42b02f8b4e1e

Timeline

Publicly Published
2024-01-16 (about 2 years ago)
Added
2024-01-24 (about 2 years ago)
Last Updated
2024-01-24 (about 2 years ago)

Other

Published
Title
Published
2025-02-03
Title
Paytm Payment Donation <= 2.3.3 - Admin+ Stored XSS
Published
2023-05-03
Title
Spiffy Calendar < 4.9.4 - Reflected XSS
Published
2025-01-16
Title
Kv Compose Email From Dashboard <= 1.1 - Reflected Cross-Site Scripting
Published
2019-01-14
Title
easy-redirect-manager 2.18.18 - Cross-Site Scripting (XSS)
Published
2023-03-27
Title
Contact Forms by Cimatti < 1.5.5 - Unauthenticated Stored XSS