Details
- Type
- Stored XSS
- Impact
- Stored XSS
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Published
- 31 October 2026
- Updated
- 1 November 2026
- Weakness
- CWE-79
Vendor fix
Update to the latest version of PPWP – Password Protect Pages plugin.
Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-116520
- https://plugins.trac.wordpress.org/browser/password-protect-page/tags/1.9.26/includes/services/class-ppw-shortcode.php#L622
- https://plugins.trac.wordpress.org/browser/password-protect-page/tags/1.9.26/includes/views/shortcode/view-ppw-restriced-content-form.php#L17
- https://plugins.trac.wordpress.org/changeset/3772960/password-protect-page/trunk/includes/services/class-ppw-shortcode.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c549ba14-276e-46ab-8019-97430a566d8c?source=cve
- https://plugins.trac.wordpress.org/browser/password-protect-page/tags/1.9.26/includes/services/class-ppw-shortcode.php#L202
- https://plugins.trac.wordpress.org/browser/password-protect-page/tags/1.9.26/includes/services/class-ppw-shortcode.php#L587
- https://plugins.trac.wordpress.org/browser/password-protect-page/tags/1.9.26/includes/services/class-ppw-shortcode.php#L598
- https://plugins.trac.wordpress.org/browser/password-protect-page/tags/1.9.26/includes/services/class-ppw-shortcode.php#L608