The Shield Security plugin for WordPress is vulnerable to Reflected Cross‑Site Scripting through the 'message' parameter. Because the plugin does not sanitize or escape this input, an attacker can embed malicious scripts that execute when a victim visits a crafted URL. The impact is the ability to run arbitrary client‑side code in the victim’s browser, enabling session hijacking, cookie theft, or the execution of phishing vectors. The weakness is a classic input validation flaw (CWE‑79).

The vulnerability affects all releases of Shield Security for WordPress up to and including version 21.0.8, issued by paultgoodchild. Any WordPress site installing the plugin in these or earlier versions is potentially exposed.

The CVSS score of 6.1 classifies this as moderate‑risk. The EPSS score of less than 1% indicates a low but non‑zero exploitation probability. The vulnerability is unauthenticated and requires only that a victim click a crafted link, which makes it easy to deploy. It is not currently listed in the CISA KEV catalog. To exploit, an attacker needs to host a URL that includes an injected payload in the 'message' parameter and convince a user to click it, which will lead to script execution in the user’s browser. This can be used to compromise user accounts or deface the site.