CVE-2026-116520

32th percentile - higher than 32% of all known CVEs

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / shortcode attribute desc_below_form (and placeholder as the marker-smuggling helper)' parameter in all versions up to, and including, 1.9.26 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

An attacker could execute arbitrary JavaScript in the browsers of users visiting the affected page, potentially leading to session or data theft. The risk is elevated because exploitation requires no authentication and the comment auto-approval mechanism facilitates payload delivery.

Update the PPWP plugin to a version later than 1.9.26 and consider disabling automatic comment approval for previously approved names and emails. Additionally, deploy CSP headers and regularly review approved comments for suspicious content.