CVE-2026-4025 is a stored cross-site scripting vulnerability in the PrivateContent Free WordPress plugin, affecting all versions up to and including 1.2.0. The issue arises from insufficient input sanitization and output escaping of the 'align' attribute in the [pc-login-form] shortcode. The attribute value is passed through pc_login_form() to pc_static::form_align() and directly concatenated into an HTML class attribute without using esc_attr() or equivalent escaping functions. This flaw allows authenticated users with Contributor-level permissions or higher to inject arbitrary JavaScript code, which executes in the context of any user viewing the compromised page. The vulnerability has a CVSS 3.1 base score of 6.4 (medium severity), with network attack vector, low attack complexity, and no user interaction required.

An attacker with Contributor-level or higher privileges can inject persistent malicious scripts into pages via the vulnerable shortcode attribute. These scripts execute in the browsers of users who visit the affected pages, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability does not affect availability and requires authentication, limiting exposure to users with some level of access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the PrivateContent Free plugin if possible. Monitor for plugin updates from lcweb-projects and apply any official patches promptly once available.