Extension WordPress
Vulnérabilités Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning
Cette page rassemble les failles publiées pour Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning
11 fiches
Shield Security <= 21.0.8 – Cross-Site Request Forgery to SQL Injection
The Shield Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 21.0.8. This is due to the plugin allowing nonce verification to be bypassed via user-supplied parameter in the 'isNonceVerifyRequired'…
*-21.0.8
21.0.10
18/02/2026
Shield Security <= 21.0.8 – Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter
The Shield Security plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 21.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
*-21.0.8
21.0.10
18/02/2026
Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches <= 21.0.9 – Missing Authorization to Authenticated (Subscriber+) Email MFA Update
The Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `MfaEmailDisable` action in all versions up to, and including,…
*-21.0.9
21.0.10
18/02/2026
Shield Security <= 21.0.9 – Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator
The Shield: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 21.0.9 via the MfaGoogleAuthToggle class due to missing validation on a…
*-21.0.9
21.0.10
15/01/2026
Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 20.0.5 – Reflected Cross-Site Scripting
The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nav_sub' parameter in all versions up to, and including, 20.0.5 due to insufficient input sanitization and…
*-20.0.5
20.0.6
05/08/2024
Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 19.1.13 – Cross-Site Request Forgery
The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 19.1.13. This is due to missing or incorrect nonce validation on…
*-19.1.10
19.1.11
01/06/2024
Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 – Unauthenticated Local File Inclusion
The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the render_action_template parameter. This makes it possible for unauthenticated…
*-18.5.9
18.5.10
05/02/2024
Shield Security <= 18.5.7 – Unauthenticated Stored Cross-Site Scripting via getColumnContent_Page
The Shield Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the getColumnContent_Page function in versions up to, and including, 18.5.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
*-18.5.7
18.5.8
16/01/2024
Shield Security <= 17.0.17 – Missing Authorization
The Shield Security plugin for WordPress is vulnerable to Missing Authorization on the 'theme-plugin-file' AJAX action in versions up to, and including, 17.0.17. This allows authenticated attackers to add arbitrary audit log entries indicating that a theme or…
[*, 17.0.18)
17.0.18
25/04/2023
Shield Security <= 17.0.17 – Unauthenticated Stored Cross-Site Scripting
The Shield Security plugin for WordPress is vulnerable to stored Cross-Site Scripting in versions up to, and including, 17.0.17 via the 'User-Agent' header. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that…
[*, 17.0.18)
17.0.18
25/04/2023
Shield Security <= 13.0.5 – Admin+ Stored Cross-Site Scripting
The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
*-13.0.5
13.0.6
19/01/2022
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.