Approved changes feed: RSS · Atom
cpe:2.3:a:paultgoodchild:shield:_blocks_bots,_protects_users,_and_prevents_security_breaches:*:*:*:*:*:*:*:*
part: a version: _blocks_bots,_protects_users,_and_prevents_security_breaches update: *
| Vendor | Paultgoodchild (f08f12a5-ad36-5efd-8f54-f57de3ac78cf) |
|---|---|
| Product | Shield (b3ab037e-370b-5dbb-8896-e03f41bfba12) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-0722 |
vulnerable | 2026-06-08 07:47:13.082917 |
Shield Security <= 21.0.8 - Cross-Site Request Forgery to SQL Injection
MEDIUM (6.5)
The Shield Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 21.0.8. This is due to the plugin allowing nonce verification to be bypassed via user-supplied parameter in the 'isNonceVerifyRequired' function. This makes it possible for unauthenticated attackers to execute SQL injection attacks, extracting sensitive information from the database, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2026-02-19T04:36:27.820Z
Updated: 2026-04-08T17:33:18.351Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-0561 |
vulnerable | 2026-06-08 07:47:12.538973 |
Shield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter
MEDIUM (6.1)
The Shield Security plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 21.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Published: 2026-02-19T04:36:23.952Z
Updated: 2026-04-08T17:23:26.711Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-15370 |
vulnerable | 2026-06-08 07:06:36.134011 |
Shield Security <= 21.0.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator
MEDIUM (4.3)
The Shield: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 21.0.9 via the MfaGoogleAuthToggle class due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disable Google Authenticator for any user.
Published: 2026-01-16T04:44:35.383Z
Updated: 2026-04-08T17:26:36.042Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-14427 |
vulnerable | 2026-06-08 07:06:34.429748 |
Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches <= 21.0.9 - Missing Authorization to Authenticated (Subscriber+) Email MFA Update
MEDIUM (4.3)
The Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `MfaEmailDisable` action in all versions up to, and including, 21.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disable the global Email 2FA setting for the entire site.
Published: 2026-02-19T04:36:19.188Z
Updated: 2026-04-08T17:09:18.558Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-4344 |
vulnerable | 2026-06-08 06:50:17.555192 |
Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 19.1.13 - Cross-Site Request Forgery
MEDIUM (4.3)
The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 19.1.13. This is due to missing or incorrect nonce validation on the exec function. This makes it possible for unauthenticated attackers to disable pin protection for the admin interface of the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2024-06-02T04:30:31.354Z
Updated: 2026-04-08T16:44:07.410Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6989 |
vulnerable | 2026-06-08 06:21:56.553352 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0993 |
vulnerable | 2026-06-08 05:52:33.586854 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0992 |
vulnerable | 2026-06-08 05:52:33.585473 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.