The Shield Security plugin for WordPress logs request paths in a hidden table column that is rendered via innerHTML. A prior partial sanitization fix applied only to a visible field, leaving the hidden path field unescaped. Unauthenticated attackers can therefore craft a malicious REQUEST_URI containing JavaScript or HTML. The payload is stored in the database and subsequently displayed to any user who views the traffic log entry, executing arbitrary code in the victim’s browser context. This can lead to session hijacking, credential theft, or site defacement.

WordPress sites running the Shield Security plugin from paultgoodchild: ‘Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning’ are affected in all releases up through and including version 22.3.2. Versions 22.3.3 and newer contain the fix that properly escapes the hidden path field.

The flaw carries a CVSS score of 7.2, placing it in the high‑severity range, and its EPSS score is not available, so the exploitation probability is uncertain but non‑negligible. The vulnerability is not listed in the CISA KEV catalog. Attackers only need to send a crafted URL containing a malicious REQUEST_URI; no authentication or elevated privileges are required. Once stored, the malicious script will execute every time an authenticated user opens the traffic log, making this a classic stored cross‑site scripting attack vector.