{
 "id": "WPSEC-2026-1882",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1882/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1882/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1882/index.md",
 "title": "Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path in Traffic Log",
 "description": "The Shield Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logged request path in all versions up to, and including, 22.3.2, due to insufficient output escaping when request log entries are returned to the admin Traffic log table. This makes it possible for unauthenticated attackers to inject arbitrary web scripts by sending a request with a crafted URL path to the site. The scripts run when an administrator views the Traffic log.",
 "plugin": {
  "slug": "wp-simple-firewall",
  "name": "Shield Security – Smart Bot Blocking & Intrusion Prevention Security",
  "full_name": "Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning",
  "wordpress_org": "https://wordpress.org/plugins/wp-simple-firewall/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-simple-firewall/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-simple-firewall"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "22.3.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 22.3.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "22.3.4",
 "remediation": "Update to 22.3.4 or later.",
 "fix_released": "2026-10-27T22:23:36+00:00",
 "published": "2026-10-28T22:44:49+00:00",
 "updated": "2026-10-28T09:11:21.399758+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1882/",
  "https://plugins.svn.wordpress.org/wp-simple-firewall/tags/22.3.4/",
  "https://wordpress.org/plugins/wp-simple-firewall/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-simple-firewall",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-28"
 }
}