CVE-2026-118057: Shield Security Plugin — Unauthenticated Stored XSS via REQUEST_URI

Executive Summary

A stored cross-site scripting (XSS) vulnerability has been disclosed in the Shield Security plugin for WordPress (Smart Bot Blocking, Brute-Force Login Protection & File Scanning). Tracked as CVE-2026-118057 with a CVSS 3.1 score of 7.2 (High), the flaw affects all versions up to and including 22.3.2.

The plugin logs request metadata, including the REQUEST_URI, and renders it in its traffic log in the admin area. Insufficient input sanitization and output escaping lets an unauthenticated attacker plant script in a logged request, which executes when an administrator views the affected page. An earlier partial fix in version 18.5.8 escaped only the visible column, leaving a hidden path field exploitable through version 22.2.6.

CVSS Score: 7.2 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Vulnerability Overview

Root Cause

Request data is captured by RequestMetaProcessor.php and displayed through the traffic table builders (ForTraffic.php, BuildTrafficTableData.php). The URI value is not fully escaped on output in every field, so attacker-chosen markup in a request path is stored and later rendered as active HTML in the administrator's browser.

Impact

Because the payload runs in an administrator's authenticated session, an attacker can:

• Perform actions as the administrator, such as creating a new admin user
• Steal or abuse session-bound data available to the page
• Install a malicious plugin or modify site content through follow-on requests

The scope change in the CVSS vector reflects that the script executes in the admin context rather than the component that stored it. Exploitation requires an administrator to open the traffic log, which lowers likelihood compared with a pure unauthenticated RCE, but any site visitor can seed the payload by simply requesting a crafted URL.

Remediation

Immediate Steps

1. Update Shield Security to 22.3.4 or later. The plugin's repository changeset between 22.3.2 and 22.3.4 contains the fix
2. Review the Shield traffic log for entries containing script, onerror, or other HTML markup in request paths
3. Audit administrator accounts and recently installed plugins if you suspect a payload was triggered

Hardening

• Enforce a strict Content-Security-Policy on wp-admin where feasible
• Limit the number of administrators and use separate accounts for routine work
• Enable MFA on all administrator accounts

Detection

Key Takeaways

1. CVSS 7.2 High — unauthenticated stored XSS in a security plugin's own log viewer
2. All versions up to 22.3.2 are affected; 22.3.4 includes the fix
3. Logged data is attacker-controlled input and must be escaped in every field where it is displayed
4. Update now and review the traffic log for injected markup

References

• NVD — CVE-2026-118057
• Wordfence Threat Intelligence entry
• Plugin source — changeset 22.3.2 to 22.3.4