CVE-2026-93293

Name of the Vulnerable Software and Affected Versions Password Protected versions prior to 2.8.5

Description Stored Cross-Site Scripting occurs via the bundled Freemius SDK purchase-completion handler due to insufficient input sanitization and output escaping. When the Freemius opt-in is active, the handler processes the purchased plan request parameter on any wp-admin request from an authenticated user without requiring specific capabilities, nonces, or purchase validation. The input is stored in a persistent, site-wide administrative notice, allowing authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts. These scripts execute automatically when an administrator views a standard admin page, such as the Profile page.

Recommendations Update Password Protected to version 2.8.5 or later.