The PPWP – Password Protect Pages WordPress plugin up to version 1.9.26 is vulnerable to a stored Cross-Site Scripting (XSS) flaw via the 'desc_below_form' shortcode attribute and comment parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. The issue arises from insufficient input sanitization and output escaping combined with WordPress comment filtering behavior and auto-approval of comments from previously approved users.
CVE-2025-9878 is a stored cross-site scripting (XSS) vulnerability in the PPWP – Password Protect Pages WordPress plugin. It affects all versions up to and including 1.9.21. The flaw arises from insufficient sanitization and escaping of user-supplied attributes in the 'ppwp' shortcode, allowing authenticated users with contributor-level access or higher to inject malicious scripts. These scripts execute when any user views the affected page. The vulnerability has a CVSS 3.1 score of 6.4, indicating a medium severity level.
The PPWP – Password Protect Pages WordPress plugin is vulnerable to PHP Object Injection via deserialization of untrusted input in the 'post_protection_roles' parameter in all versions up to and including 1.9.18. This vulnerability requires authenticated users with Contributor-level access or higher. Exploitation depends on the presence of a PHP Object Injection POP chain in other installed plugins or themes. Without such a POP chain, the vulnerability has no impact. If a POP chain is present, attackers could potentially delete files, access sensitive data, or execute arbitrary code.
The PPWP: Password Protect Pages plugin for WordPress contains an improper authorization vulnerability in the can_access function affecting all versions up to and including 1.9.15. This flaw allows authenticated users with Contributor-level access or higher to retrieve the master password and access any password-protected content. The vulnerability has a medium severity rating with a CVSS score of 4.3.
The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppw_free_set_password AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to update the password on any password protected post and subsequently access the content.
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ppwp` shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the `get_advance_file_by_url()` method in all versions up to, and including, 2.8.8.8 The method uses a SQL `LIKE` operator for token lookup without escaping wildcard characters via `$wpdb->esc_like()`. This makes it possible for unauthenticated attackers to bypass the private token requirement by supplying SQL wildcard characters (such as `%`) as the token value, matching any record in the plugin's file table and downloading any protected file.
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.9 via API. This makes it possible for unauthenticated attackers to obtain post titles, IDs, slugs as well as other information including for password-protected posts.