Admin stored XSS via unsanitized notes

Cross-site scripting in Shield Security before 13.0.6 allows remote authenticated users with high privileges to execute script via crafted admin notes. The plugin stores administrator-supplied note content without sanitizing or escaping it before rendering the notes page, so a malicious payload executes when a privileged administrator views the note even when unfiltered_html is disallowed. Exploitation requires a high-privilege WordPress account and administrator interaction with the affected notes page; the demonstrated impact is script execution in that administrator’s browser context.