CVE-2023-0992

Deeper analysis

The Shield Security plugin for WordPress, also known as wp-simple-firewall, is affected by a stored cross-site scripting vulnerability (CWE-79) in versions up to and including 17.0.17. The flaw resides in the handling of the User-Agent HTTP header, which permits injection of arbitrary scripts that are stored and later executed in the context of users who view the affected pages. The issue carries a CVSS 3.1 score of 7.2 with network attack vector, no authentication or user interaction required, and limited confidentiality and integrity impact under changed scope.

Unauthenticated remote attackers can exploit the vulnerability simply by supplying a crafted User-Agent header in requests to a site running the vulnerable plugin. Successful exploitation results in persistent script execution whenever an administrator or other user accesses a page that renders the injected content, enabling actions such as cookie theft, defacement, or redirection within the site’s administrative interface.

Public advisories from Wordfence and the plugin’s Trac changesets indicate that the issue was addressed in a subsequent release; site operators are advised to update the Shield Security plugin to the latest version available through the WordPress repository. The referenced patches and developer changelog confirm remediation of the header-handling logic that permitted the stored XSS.

EPSS for this CVE reached a peak of 0.3875 before receding to the current value of 0.2441, indicating a period of elevated exploitation interest after disclosure.