Executive brief
The Password Protect WordPress plugin, used to restrict access to pages with password protection, contains a stored cross-site scripting (XSS) vulnerability in its shortcode functionality. An authenticated attacker with contributor-level permissions or higher can inject malicious scripts into protected pages that will execute for all visitors, potentially compromising user sessions, stealing credentials, or defacing site content.
Technical details
The vulnerability is a Stored XSS flaw in the 'ppwp' shortcode due to insufficient input sanitization and output escaping of user-supplied shortcode attributes. An authenticated user with contributor or higher privileges can craft a malicious shortcode with unescaped payloads that are stored in the page content and executed in the browsers of all site visitors. The vulnerability affects all versions up to and including 1.9.21. No evidence of active exploitation or patch availability is mentioned in the advisory.
Affected products
- WPZSR (Password Protect Page) Password Protect WordPress up to and including 1.9.21
Timeline
- 2026-08-25: disclosed