CVE-2026-116520

Name of the Vulnerable Software and Affected Versions PPWP – Password Protect Pages versions prior to 1.9.27

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. This is achieved via the desc below form parameter within comments or shortcode attributes, using a placeholder as a marker-smuggling helper. Attackers can inject arbitrary web scripts into pages that execute when accessed by users. The issue is facilitated by the WordPress comment content filter, which does not modify bare shortcode text lacking HTML tags, and the comment whitelist setting, which may auto-approve comments from previously verified identities.

Recommendations Update PPWP – Password Protect Pages to version 1.9.27 or later.