Skip to content
Noroxi

Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning

wp-simple-firewall · plugin

Known security vulnerabilities for Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning. Find out in seconds which version runs on your site with WP Lens.

9 known vulnerabilities

1 critical · 6 exploitable without logging in · 2 with public exploit code · latest Feb 19, 2026

Listed on wordpress.org · latest 22.2.3 · last updated Sep 21, 2026 · 30K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2023-6989unauthenticated≤ 18.5.9

    Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion

    Critical 9.8

  • CVE-2026-0722unauthenticated · needs a click≤ 21.0.8

    Shield Security <= 21.0.8 - Cross-Site Request Forgery to SQL Injection

    Medium 6.5

  • CVE-2026-0561unauthenticated · needs a click≤ 21.0.8

    Shield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter

    Medium 6.1

  • CVE-2024-22163unauthenticated · needs a click≤ 18.5.7

    WordPress Shield Security Plugin <= 18.5.7 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2023-0992unauthenticated→ 17.0.18

    Shield Security <= 17.0.17 - Unauthenticated Stored Cross-Site Scripting

    Medium 6.1

  • CVE-2024-4344unauthenticated · needs a click≤ 19.1.10

    Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 19.1.13 - Cross-Site Request Forgery

    Medium 4.3

  • CVE-2025-14427subscriber+≤ 21.0.9

    Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches <= 21.0.9 - Missing Authorization to Authenticated (Subscriber+) Email MFA Update

    Medium 4.3

  • CVE-2025-15370subscriber+≤ 21.0.9

    Shield Security <= 21.0.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator

    Medium 4.3

  • CVE-2023-0993login required→ 17.0.18

    Shield Security <= 17.0.17 - Missing Authorization

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory