# Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path in Traffic Log

- **ID:** WPSEC-2026-1882
- **Plugin:** Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning (`wp-simple-firewall`), https://wordpress.org/plugins/wp-simple-firewall/
- **Affected versions:** all versions before 22.3.4
- **Fixed in:** 22.3.4 (Update to 22.3.4 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-simple-firewall
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1882/

## Description

The Shield Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logged request path in all versions up to, and including, 22.3.2, due to insufficient output escaping when request log entries are returned to the admin Traffic log table. This makes it possible for unauthenticated attackers to inject arbitrary web scripts by sending a request with a crafted URL path to the site. The scripts run when an administrator views the Traffic log.

## References

- https://wpsec.com/vuln/WPSEC-2026-1882/
- https://plugins.svn.wordpress.org/wp-simple-firewall/tags/22.3.4/
- https://wordpress.org/plugins/wp-simple-firewall/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1882/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.