CVE-2024-7313

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Shield Security WordPress plugin before 20.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Shield Security	< 20.0.6
getshieldsecurity	shield_security	< 20.0.6

References

https://wpscan.com/vulnerability/83a1bdc6-098e-43d5-89e5-f4202ecd78a1/Exploit, Third Party Advisory

Timeline

Published: Aug 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-73149.8anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to CVE-2024-73157.5The Migration, Backup, Staging WordPress plugin before 0.9.106 does not use sufficient randomness in the filename that is created when gene CVE-2024-73165.9Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric CNC Series allows a remote unauthenticated attacker CVE-2024-73175.4The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Stored Cr CVE-2024-73184.8A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds CVE-2024-73195.0An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack CVE-2024-73209.8A vulnerability classified as critical has been found in itsourcecode Online Blood Bank Management System 1.0. This affects an unknown part CVE-2024-73216.1A vulnerability classified as problematic was found in itsourcecode Online Blood Bank Management System 1.0. This vulnerability affects unkn CVE-2024-73225.8A ZigBee coordinator, router, or end device may change their node ID when an unsolicited encrypted rejoin response is received, this change CVE-2024-73236.5Digiwin EasyFlow .NET lacks proper access control for specific functionality, and the functionality do not adequately filter user input. A r CVE-2024-73247.8A vulnerability was found in IObit iTop Data Recovery Pro 4.4.0.687. It has been declared as critical. Affected by this vulnerability is an CVE-2024-73257.8A vulnerability was found in IObit Driver Booster 11.0.0.0. It has been rated as critical. Affected by this issue is some unknown functional