CVE-2026-4025
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The PrivateContent Free plugin for WordPress, all versions up to and including 1.2.0, has a Stored XSS vulnerability via the 'align' shortcode attribute in the [pc-login-form] shortcode. The attribute is not properly sanitized or escaped, allowing authenticated attackers with Contributor-level access and above to inject arbitrary scripts.
Risk Assessment
An attacker can inject a persistent script that executes whenever a user visits the infected page, potentially leading to session theft, redirects, or other actions on the victim's account.
Recommendation
Update the PrivateContent Free plugin to the latest version that contains a fix. If not available, temporarily remove or disable the plugin.
Original NVD description (English source)
The PrivateContent Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' shortcode attribute in the [pc-login-form] shortcode in all versions up to, and including, 1.2.0. This is due to insufficient input sanitization and output escaping on the 'align' attribute. Specifically, the attribute value flows from the shortcode through pc_login_form() to pc_static::form_align(), where it is directly concatenated into an HTML class attribute without esc_attr() or any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.