CVE-2026-3639 in PPWP Password Protect Pages Plugin
Summary
by MITRE • 08/13/2026
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ppwp` shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/13/2026
The PPWP – Password Protect Pages plugin for WordPress represents a critical security vulnerability classified as stored cross-site scripting within its shortcode implementation. This flaw affects all versions through 1.9.21 and stems from inadequate input sanitization and output escaping mechanisms that fail to properly validate user-supplied attributes. The vulnerability specifically targets the plugin's ppwp shortcode functionality where malicious payloads can be injected into attribute values that are subsequently rendered without proper security controls.
The technical execution of this vulnerability requires authenticated attackers possessing at least contributor-level privileges within the WordPress environment. This access level provides sufficient permissions to modify page content and inject malicious code through the vulnerable shortcode attributes. The flaw operates as a stored XSS because the malicious scripts are permanently saved within the plugin's data storage rather than being reflected in responses, making the attack persistent and capable of affecting multiple users over time.
From an operational impact perspective, this vulnerability creates significant security risks for WordPress sites utilizing the affected plugin version. Any user who accesses a page containing the injected malicious code becomes a potential victim of the stored XSS attack, which can lead to session hijacking, credential theft, or redirection to malicious websites. The authenticated nature of the attack means that attackers do not need to rely on social engineering tactics to gain access to privileged accounts, as they can leverage their existing contributor permissions to deploy malicious payloads.
The vulnerability aligns with CWE-79, which specifically addresses cross-site scripting flaws in web applications, and demonstrates how insufficient input validation can create persistent security weaknesses in content management systems. From the MITRE ATT&CK framework perspective, this vulnerability maps to techniques involving command and control communications and credential access through compromised user accounts, as attackers can leverage the stored XSS to establish persistent access or extract sensitive information from victim sessions.
Mitigation strategies should prioritize immediate patching to versions beyond 1.9.21 where the sanitization issues have been resolved. Administrators should also implement additional security measures including regular monitoring of page content modifications, restriction of contributor-level permissions to only essential users, and implementation of web application firewalls that can detect and block suspicious shortcode attribute patterns. Network-level protections such as content security policies and proper input validation at multiple layers provide additional defense-in-depth controls against exploitation attempts while maintaining the plugin's legitimate functionality for authorized users.