/Vulnerability Library

Shield Security <= 21.0.8 - Unauthenticated Reflected XSS

CVE-2026-0561
Verified

Description

Shield Security WordPress plugin <= 21.0.8 contains a reflected cross-site scripting caused by insufficient input sanitization and output escaping in the 'message' parameter, letting unauthenticated attackers inject scripts, exploit requires user interaction.

Severity

Medium

CVSS Score

6.1

Exploit Probability

1%

Affected Product

shield-security

Published Date

September 7, 2026

Template Author

str4k3r

CVE-2026-0561.yaml
6.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE ID:
cve-2026-0561
CWE ID:
cwe-79

References

https://research.cleantalk.org/cve-2026-0561/https://www.wordfence.com/threat-intel/vulnerabilities/id/cb49eb5f-c1ff-4440-8b53-c2515e65da27?source=cvehttps://nvd.nist.gov/vuln/detail/CVE-2026-0561

Remediation Steps

Update to a version later than 21.0.8 or the latest available version.