Password Protect WordPress: Stored Cross-Site Scripting (CVE-2026-116520)

The PPWP - Password Protect Pages plugin for WordPress (versions up to and including 1.9.26) contains a Stored Cross-Site Scripting vulnerability. Insufficient input sanitization and output escaping of the 'desc_below_form' and 'placeholder' attributes allow unauthenticated attackers to inject arbitrary web scripts into WordPress pages. The vulnerability is further enabled by the plugin's comment filtering logic, which ignores bare shortcode text, and the 'comment_whitelist' setting, which can auto-approve comments from previously approved authors.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of the WordPress site when a victim views an injected page. This may lead to session hijacking, unauthorized actions performed on behalf of administrators, or further redirection of users to malicious sites.

Recommendation

• Update the PPWP - Password Protect Pages plugin to the version following 1.9.26 (or the latest available patch) as soon as it becomes available.
• Review the 'comment_whitelist' configuration in the WordPress administrative panel and disable it if not strictly required to mitigate the persistence of unauthenticated malicious comments.
• Implement a Content Security Policy (CSP) to restrict the execution of unauthorized inline scripts on the WordPress installation.
• Hunt for web requests containing malicious script tags or JavaScript event handlers (e.g., onerror, onload, onclick) directed at pages utilizing the vulnerable shortcodes.