CVE-2023-0992 Shield Security <= 17.0.17 - Unauthenticated Stored Cross-Site Scripting

What is CVE-2023-0992?

CVE-2023-0992 is a high-severity cross-site scripting vulnerability in paultgoodchild Shield: Blocks Bots, Protects Users, and Prevents Security Breaches, published on 9 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Shield Security plugin for WordPress is vulnerable to stored Cross-Site Scripting in versions up to, and including, 17.0.17 via the 'User-Agent' header. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Weakness: CWE-79

Which versions are affected by CVE-2023-0992?

It affects 1 product.

Products include Getshieldsecurity Shield Security.

How do I fix CVE-2023-0992?

No fix has been published for CVE-2023-0992 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-0992 being exploited?

There is no known exploitation of CVE-2023-0992 in the wild and no public exploit code.

Other vulnerabilities in paultgoodchild Shield: Blocks Bots, Protects Users, and Prevents Security Breaches

• CVE-2023-6989 Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion Critical 9.8
• CVE-2024-22163 WordPress Shield Security Plugin <= 18.5.7 is vulnerable to Cross Site Scripting (XSS) High 7.1
• CVE-2024-7313 Shield Security < 20.0.6 - Reflected XSS Medium 6.1
• CVE-2022-0211 Shield Security < 13.0.6 - Admin+ Stored Cross-Site Scripting Medium 4.8
• CVE-2023-0993 Shield Security <= 17.0.17 - Missing Authorization Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2p6c-99qx-rqfx.