CVE-2026-3639

Name of the Vulnerable Software and Affected Versions PPWP – Password Protect Pages versions prior to 1.9.22

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes within the ppwp shortcode. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update PPWP – Password Protect Pages to version 1.9.22 or later.