title: Shield Security < 13.0.6 - Admin+ Stored Cross-Site Scripting
description: The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Shield Security – Scanners, Security Hardening, Brute Force Protection & Firewall
vendor: Unknown
versions:
lessThan: 13.0.6, status: affected, version: 13.0.6, versionType: custom
}