The PPWP – Password Protect Pages WordPress plugin suffers from a stored XSS vulnerability (CWE-79) in its 'ppwp' shortcode implementation. This vulnerability arises from improper neutralization of input during web page generation, specifically insufficient input sanitization and output escaping of user-supplied shortcode attributes. Authenticated attackers with contributor or higher privileges can exploit this to inject arbitrary JavaScript that executes in the context of users visiting the compromised pages. The issue affects all versions up to and including 1.9.21. No official patch or remediation level has been published yet.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages protected by the plugin. These scripts execute in the browsers of users who visit the infected pages, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The vulnerability does not impact availability but compromises confidentiality and integrity of user interactions with the affected site.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisory for updates. Until a fix is released, restricting contributor-level access and above to trusted users may reduce risk. Applying general WordPress security best practices for user roles and input validation is recommended but may not fully mitigate this specific vulnerability.