CVE-2025-9878: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in buildwps PPWP – Password Protect Pages

The PPWP – Password Protect Pages plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) in its 'ppwp' shortcode implementation. Due to inadequate input sanitization and output escaping of user-supplied attributes, authenticated attackers with contributor-level privileges or above can inject arbitrary JavaScript code into pages. This malicious code executes in the context of any user who accesses the compromised page, potentially leading to session hijacking or other client-side attacks. The vulnerability affects all plugin versions from the initial release through 1.9.21.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages protected by the plugin. These scripts execute in the browsers of users who view the infected pages, potentially leading to theft of sensitive information, session hijacking, or other client-side impacts. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent, as reflected in the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: None).

No official patch or fix is currently confirmed for this vulnerability. Users should check the vendor's advisory or plugin updates regularly for a fix. Until a patch is available, restrict contributor-level access to trusted users only and consider disabling or removing the 'ppwp' shortcode usage where possible to mitigate risk.