CVE-2026-116520 in PPWP Plugin
Summary
by MITRE • 10/31/2026
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / shortcode attribute desc_below_form (and placeholder as the marker-smuggling helper)' parameter in all versions up to, and including, 1.9.26 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because WordPress's comment_content filter leaves bare shortcode text (containing no HTML tags) untouched, and the comment_whitelist setting auto-approves subsequent comments from a previously approved name and email without administrator intervention.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/31/2026
The PPWP – Password Protect Pages plugin for WordPress contains a critical stored cross-site scripting vulnerability affecting all versions up to 1.9.26. This flaw stems from insufficient input sanitization and output escaping within the comment shortcode attribute desc_below_form, which serves as an entry point for malicious script injection. The vulnerability is particularly severe because it allows unauthenticated attackers to inject arbitrary web scripts into pages protected by the plugin. When a legitimate user accesses such a page, the injected scripts execute in their browser context, potentially leading to session hijacking, credential theft, or defacement of the website content.
The technical mechanism behind this exploitation relies on specific behaviors within WordPress core functionality that interact poorly with the plugin's handling of comment data. Specifically, the WordPress comment_content filter leaves bare shortcode text untouched if it contains no HTML tags. This behavior creates a blind spot where attackers can smuggle malicious payloads disguised as harmless shortcodes or plain text. Furthermore, the vulnerability is exacerbated by the WordPress comment_whitelist setting, which automatically approves subsequent comments from users whose name and email address have previously been approved for commenting on that specific post. This feature allows an attacker to bypass manual moderation entirely after a single successful injection attempt, ensuring their malicious payload remains active without administrative intervention.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). The stored nature of the attack means that the malicious code is persisted on the target server and served to multiple victims over time, distinguishing it from reflected XSS attacks. In terms of tactical mapping within the MITRE ATT&CK framework for Enterprise or Mobile, this vulnerability facilitates initial access through phishing-like interactions if combined with social engineering, but more directly relates to execution via browser-based scripts. It also touches upon privilege escalation concepts since unauthenticated users can effectively alter page content and potentially steal sensitive information from authenticated administrators who view the compromised pages.
The operational impact of this flaw is significant for any WordPress site utilizing PPWP to protect specific pages or posts. Attackers do not need valid credentials to exploit this vulnerability, lowering the barrier to entry significantly. Once executed, the malicious scripts can perform a wide range of harmful actions depending on what permissions the victim user holds. For instance, if an administrator views a compromised page, their administrative session could be hijacked, granting the attacker full control over the WordPress installation. Even for regular users, the impact includes loss of privacy and potential compromise of accounts linked to that browser session through cookies or local storage theft.
Mitigation strategies should focus on immediate remediation and long-term security hardening. The most effective solution is to upgrade the PPWP – Password Protect Pages plugin to version 1.9.27 or later, where this input validation issue has been addressed by developers implementing stricter sanitization of comment content before it is stored in the database and proper escaping when rendered on the frontend. Until an update can be applied, site administrators should consider disabling comments on pages protected by PPWP if such functionality is not strictly required. Additionally, enabling strict Content Security Policy headers can help mitigate the impact of any successfully injected scripts by restricting the sources from which executable content can be loaded. Regular security audits and monitoring for unusual comment activity are also recommended to detect potential exploitation attempts early.