Stored Cross-Site Scripting Vulnerability in Smart Bot Blocking Plugin for WordPress
CVE-2026-118057

7.2HIGH

Key Information:

Vendor

WordPress
Status
Shield Security – Smart Bot Blocking, Brute-force Login Protection & File Scanning
Vendor
CVE Published:
31 October 2026

What is CVE-2026-118057?

The Smart Bot Blocking plugin for WordPress has a vulnerability that allows stored Cross-Site Scripting (XSS) attacks through the 'REQUEST_URI' parameter. This issue arises from inadequate input sanitization and output escaping, exposing all versions up to and including 22.3.2. Unauthenticated attackers can exploit this flaw to inject malicious scripts that run when users access the affected pages. Specifically, the hidden 'path' column in the ForTraffic.php file is not subjected to a client-side render function, leading to the execution of stored HTML as live DOM nodes, thanks to DataTables utilizing innerHTML improperly. A previous attempt to mitigate this in version 18.5.8 only esc_html() the 'page' column, neglecting the hidden 'path', which remains exposed to exploitation.

Affected Version(s)

Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning 0 <= 22.3.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-simple-fire...
https://plugins.trac.wordpress.org/browser/wp-simple-fire...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kevin Whelan
.