What is the CVSS score of CVE-2025-9878?

CVE-2025-9878 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

PPWP Password Plugin CVE-2025-9878

EUVD-2025-210770 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-25 Wordfence

GHSA-gr4q-7mpw-mwqc

WordPress XSS Wordpress Plugin Ppwp Password Protect Pages Buildwps

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Contributor account required (PR:L); a victim must view the injected page (UI:R); payload executes in visiting user's browser scope (S:C), with no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 25, 2026 - 03:31 vuln.today

CVE Published

Aug 25, 2026 - 02:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The PPWP - Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppwp' shortcode in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored XSS in the PPWP - Password Protect Pages WordPress plugin (all versions up to and including 1.9.21) allows authenticated contributors to inject persistent malicious scripts via unsanitized attributes in the 'ppwp' shortcode. Any user or administrator who subsequently loads an affected page will execute the injected script in their browser, enabling session hijacking, credential theft, or escalated site compromise. No public exploit code or CISA KEV listing is identified at time of analysis; however, the CVSS Scope:Changed rating reflects meaningful cross-origin impact on visiting users beyond the injecting contributor.

Technical ContextAI

The vulnerability originates in the shortcode handler at includes/services/class-ppw-shortcode.php (line 544, referenced via the plugins.trac.wordpress.org source browser for the 1.9.12 tag) where user-supplied shortcode attributes are written to HTML output without sanitization or encoding. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes this root cause class: attacker-controlled string data flows into rendered HTML, enabling script injection. The CPE identifier cpe:2.3:a:buildwps:ppwp_-_password_protect_pages:*:*:*:*:*:*:*:* confirms the affected component is the buildwps-authored plugin distributed under the WordPress.org slug 'password-protect-page'. The CVSS S:C (Scope Changed) metric reflects that the injected payload executes in the browser security context of visiting users - a distinct principal from the contributor who inserted the shortcode.

RemediationAI

Update the PPWP - Password Protect Pages plugin to a version beyond 1.9.21 as soon as a patched release is available in the WordPress Plugin Directory. Two upstream commits have been applied to the plugin repository (changesets 3637624 and 3642939 at plugins.trac.wordpress.org), confirming that fixes were submitted upstream; however, the exact released version number incorporating these patches is not confirmed in available data and should be verified directly in the WordPress Plugin Directory or via the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/99772f4b-4152-42dc-8bde-697bba3d031f. As an interim workaround on sites where immediate update is not feasible, restrict contributor-level role assignment to fully trusted users only, or remove the capability to publish or edit posts from contributors - note that this may break existing editorial workflows. Disabling the 'ppwp' shortcode output entirely via a capability-restriction plugin is an alternative but will break password-protected pages that rely on it. Additionally, deploying a WAF rule (Wordfence provides one for premium subscribers) targeting malicious shortcode attribute injection can reduce exposure during the patching window.