CVE-2024-7313— Shield Security < 20.0.6 - Reflected XSS
Quick assessment
Affected
Unknown Shield Security
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Shield Security 20.0.6之前版本存在安全漏洞，该漏洞源于在将参数输出回页面之前未对其进行清理和转义，从而导致容易受到反射型跨站脚本攻击。
Public Exploits 1
Nuclei · 1
CVE-2024-7313.yaml [template]
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-7313
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Shield Security < 20.0.6 - Reflected XSS
Source: CVE Program / CVE List V5
Vulnerability Description
The Shield Security WordPress plugin before 20.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress plugin Shield Security 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Shield Security 20.0.6之前版本存在安全漏洞，该漏洞源于在将参数输出回页面之前未对其进行清理和转义，从而导致容易受到反射型跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Shield Security | 0 ~ 20.0.6 | - |
|
II. Public POCs for CVE-2024-7313
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | Custom Proof-of-Concept on XSS to Unauthorized Admin Account Creation via WordPress Plugin Shield Security < 20.0.6 | https://github.com/Wayne-Ker/CVE-2024-7313 | POC Details |
| 2 | The Shield Security WordPress plugin before 20.0.6 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape the 'nav_sub' parameter in the admin dashboard, allowing authenticated users to execute arbitrary JavaScript in the context of other authenticated administrators. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7313.yaml | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-7313
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-110527
WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creat -
CVE-2026-97314
ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affi -
CVE-2026-81344
Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object -
CVE-2026-81343
Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated AC -
CVE-2026-106470
WP Data Access < 5.5.88 - Subscriber+ SSRF
V. Comments for CVE-2024-7313
No comments yet