Description

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ppwp` shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-13T08:16:46.093Z",
  "pubdate": "2026-08-13T08:16:46.093Z",
  "executiveSummary": "The PPWP – Password Protect Pages plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to, and including, 1.9.21. The flaw arises from inadequate input sanitization and output escaping mechanisms applied to user-supplied attributes processed by the plugin's `ppwp` shortcode.\nSuccessful exploitation of this security issue enables authenticated attackers possessing contributor-level access privileges, or higher, to successfully inject arbitrary web scripts or HTML payloads into vulnerable posts or pages. When targeted pages are subsequently rendered to site visitors or administrators, the injected scripts execute within the context of the victim's browser session.\nThis vulnerability poses a significant risk to the confidentiality and integrity of affected WordPress installations, as malicious payloads can perform unauthorized actions, capture sensitive session cookies, or pivot further against the web application. Remediation requires updating the affected plugin once a secure patch is made available by the vendor, alongside strict enforcement of the principle of least privilege regarding user roles.",
  "technicalDetails": "The root cause of this Stored Cross-Site Scripting vulnerability resides in the insecure handling of user-supplied attributes processed by the `ppwp` shortcode within the PPWP – Password Protect Pages plugin. Specifically, the vulnerable component fails to adequately sanitize input parameters and omits proper contextual output escaping before rendering shortcode attributes back to the Document Object Model (DOM).\nThe attack vector requires the adversary to possess authenticated access to the WordPress environment with a minimum privilege level of contributor. While contributors cannot directly publish posts, they can submit content for review or author drafts containing the malicious shortcode payload. An attacker injects the exploit string directly into one of the vulnerable `ppwp` shortcode attributes.\nUpon rendering the page containing the malicious shortcode—either during preview, administrative review, or after publication—the unsanitized attribute values are parsed by the plugin and reflected directly into the HTML response without appropriate neutralization of script contexts. Consequently, the browser interprets the injected data as executable JavaScript rather than plain text.\nThe attack flow proceeds as follows: 1) The authenticated attacker creates or edits a post/page containing the maliciously crafted `ppwp` shortcode embedding arbitrary JavaScript payloads; 2) The post is saved, storing the malicious payload persistently within the WordPress database; 3) A victim (such as an administrator or regular site visitor) navigates to the compromised page; 4) The server processes the shortcode and returns the unescaped payload within the HTML response; 5) The victim's browser executes the script in the context of their active session, potentially leading to session hijacking, credential theft, or unauthorized administrative actions performed on behalf of the victim.\nAffected versions include all iterations of the PPWP – Password Protect Pages plugin up to, and including, 1.9.21. The vulnerability is exploitable locally within the application context by authenticated actors with contributor-level privileges or above, requiring no direct network exposure beyond standard web application access."
}