ppwp_password_protect_pages vulnerabilities

CVEs whose affected-version data names the ppwp_password_protect_pages package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-116520High· 7.2

6d ago

PPWP <= 1.9.26 - Unauthenticated Stored Cross-Site Scripting via '[ppwp]' Shortcode 'desc_below_form' Attribute via Placeholder Marker Collision

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / shortcode attribute desc_below_form (and placeholder as the marker-smuggling helper)' parameter in all versions up to,…

▾ Twilightbuildwps · PPWP – Password Protect PagesEPSS 0.38%via CVEORG