WP Shieldon 1.6.3 - Unauthenticated Cross-Site Scripting (XSS)

The WP Shieldon WordPress plugin, versions 1.6.3 and below, were vulnerable to Unauthenticated Reflected Cross-Site Scripting (XSS) when the CAPTCHA page is shown.

This was due to $_SERVER['REQUEST_URI'] being echoed to a page without any encoding.

http://www.example.com/?<script>alert(1)</script>