{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-116520/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:password_protect_wordpress:password_protect_pages:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-116520"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PPWP – Password Protect Pages (\u003c= 1.9.26)"],"_cs_severities":["high"],"_cs_tags":["xss","web-vulnerability","wordpress","cve-2026-116520"],"_cs_type":"advisory","_cs_vendors":["Password Protect WordPress"],"content_html":"\u003cp\u003eThe PPWP - Password Protect Pages plugin for WordPress (versions up to and including 1.9.26) contains a Stored Cross-Site Scripting vulnerability. Insufficient input sanitization and output escaping of the 'desc_below_form' and 'placeholder' attributes allow unauthenticated attackers to inject arbitrary web scripts into WordPress pages. The vulnerability is further enabled by the plugin's comment filtering logic, which ignores bare shortcode text, and the 'comment_whitelist' setting, which can auto-approve comments from previously approved authors.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of the WordPress site when a victim views an injected page. This may lead to session hijacking, unauthorized actions performed on behalf of administrators, or further redirection of users to malicious sites.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the PPWP - Password Protect Pages plugin to the version following 1.9.26 (or the latest available patch) as soon as it becomes available.\u003c/li\u003e\n\u003cli\u003eReview the 'comment_whitelist' configuration in the WordPress administrative panel and disable it if not strictly required to mitigate the persistence of unauthenticated malicious comments.\u003c/li\u003e\n\u003cli\u003eImplement a Content Security Policy (CSP) to restrict the execution of unauthorized inline scripts on the WordPress installation.\u003c/li\u003e\n\u003cli\u003eHunt for web requests containing malicious script tags or JavaScript event handlers (e.g., onerror, onload, onclick) directed at pages utilizing the vulnerable shortcodes.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T07:51:36Z","date_published":"2026-10-31T07:51:36Z","id":"https://feed.craftedsignal.io/briefs/2026-10-ppwp-xss/","summary":"The PPWP Password Protect Pages plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting via improper input sanitization in shortcode attributes, allowing script injection into pages.","title":"Password Protect WordPress: Stored Cross-Site Scripting (CVE-2026-116520)","url":"https://feed.craftedsignal.io/briefs/2026-10-ppwp-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-116520","version":"https://jsonfeed.org/version/1.1"}