CVE-2026-3639 is a stored cross-site scripting vulnerability in the PPWP – Password Protect Pages WordPress plugin (buildwps). The flaw exists in the handling of the plugin's ppwp shortcode attributes, where input is not properly sanitized or escaped before being rendered in web pages. This allows authenticated attackers with contributor-level privileges or above to inject arbitrary JavaScript code that executes in the context of users viewing the compromised pages. The vulnerability affects all versions up to and including 1.9.21. No official remediation or patch information is currently available.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages protected by the plugin. These scripts execute in the browsers of users who visit the injected pages, potentially leading to session hijacking, unauthorized actions, or data theft within the context of the affected site. The vulnerability does not impact availability but compromises confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the plugin if possible to prevent exploitation.