{"id":"CVE-2026-93293","title":"Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler","summary":"The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's purchase-completion handler in all versions up to, and including, 2.8.4 due to insufficient input sanitization and ou…","severity":"medium","cvss":6.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"saadiqbal","product":"Password Protected – Protect Your Site Content With a Password","affected":["password_protected_protect_your_site_content_with_a_password <= 2.8.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-29T10:34:09.691037Z"},"published":"2026-10-29","updated":"2026-10-29","sourceUpdated":"2026-10-29T10:45:42.261Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-93293","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c0fe97a-a9e4-46e0-bb53-135c2d9a69a4?source=cve"},{"url":"https://ti.wordfence.io/vendors/patch/3925/download"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3766681%40password-protected%2Ftags%2F2.8.5&old=3627972%40password-protected%2Ftags%2F2.8.4"}],"tags":["cve.org"],"epss":0.00187,"epssPercentile":0.08328,"ingestedAt":"2026-10-31T05:18:25.267Z","slug":"CVE-2026-93293","body":"## Overview\n\nThe Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's purchase-completion handler in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. Once the site's Freemius opt-in is complete (the normal state after an administrator clicks \"Allow & Continue\"), the handler processes the 'purchased_plan' request parameter on any wp-admin request from an authenticated user without any capability, nonce, or purchase validation, and stores it in a persistent, site-wide administrative notice. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts that execute automatically when an administrator views a standard admin page such as their Profile page.\n\n## Affected\n\n- `password_protected_protect_your_site_content_with_a_password <= 2.8.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":35.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}