Executive brief
The PrivateContent Free plugin for WordPress, which is used to manage restricted content and user logins, contains a security flaw in its login form component. This vulnerability allows users with basic contributor-level access to inject malicious scripts into website pages. When other users or administrators visit these pages, the scripts can execute, potentially leading to unauthorized actions or data theft.
Technical details
The PrivateContent Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'align' attribute within the [pc-login-form] shortcode. The vulnerability exists because the attribute value flows from the shortcode through pc_login_form() to pc_static::form_align(), where it is directly concatenated into an HTML class attribute without using esc_attr() or similar escaping functions. Authenticated attackers with Contributor-level permissions or higher can exploit this to inject malicious JavaScript into a page. The script will then execute in the context of any user who views the compromised page. The issue affects all versions up to and including 1.2.0.
Affected products
- lcweb-projects PrivateContent Free up to, and including, 1.2.0
Timeline
- 2026-04-08: advisory: Initial disclosure by Wordfence and NVD
References
- https://plugins.trac.wordpress.org/browser/privatecontent-free/tags/1.2.0/classes/pc_static.php
- https://plugins.trac.wordpress.org/browser/privatecontent-free/tags/1.2.0/main_includes/public_api.php
- https://plugins.trac.wordpress.org/browser/privatecontent-free/tags/1.2.0/main_includes/shortcodes.php
- https://plugins.trac.wordpress.org/browser/privatecontent-free/trunk/classes/pc_static.php
- https://plugins.trac.wordpress.org/browser/privatecontent-free/trunk/main_includes/public_api.php
- https://plugins.trac.wordpress.org/browser/privatecontent-free/trunk/main_includes/shortcodes.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3497358%40privatecontent-free&new=3497358%40privatecontent-free&sfp_email=&sfph_mail=