PPWP Password Plugin CVE-2025-9878

Exploitation requires a valid WordPress account with contributor role or higher (PR:L confirmed by the provided CVSS vector). The attacker must have the ability to create or edit posts or pages that render the 'ppwp' shortcode. A victim - any site user, including administrators - must subsequently browse to the page containing the injected shortcode for the stored payload to execute in their browser. Exploitation is bounded by: (1) sites where untrusted or externally registered users hold contributor-level roles or above; (2) WordPress installations running PPWP plugin version 1.9.21 or earlier; and (3) the requirement that at least one other user views the attacker-controlled content. Sites that disable open contributor registration or require administrator approval for all editorial accounts have a materially reduced attack surface.

The CVSS 6.4 Medium vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects network-accessible, low-complexity exploitation gated only by contributor-level authentication. Real-world risk is moderate but non-trivial: contributor accounts are a routine presence on WordPress sites with editorial workflows or guest posting, making the authentication barrier comparatively low. The Scope:Changed flag elevates practical impact - a stolen admin session obtained via the injected XSS can lead to full site takeover. No CISA KEV listing is present and no public exploit code is identified in available intelligence, reducing immediate mass-exploitation risk; however, WordPress plugin XSS vulnerabilities with low-privilege triggers are frequently targeted by automated scanning infrastructure, so the absence of current exploitation is not a permanent condition. The combination of stored persistence (payload survives across sessions) versus reflected XSS, and the low privilege requirement, makes this meaningfully more dangerous than the raw CVSS midrange score might suggest to teams triaging a large vulnerability backlog.

An attacker registers or compromises a contributor-level WordPress account on the target site, then creates a post or page embedding a 'ppwp' shortcode with a crafted attribute containing injected JavaScript - for example, an inline event handler or script tag - that the plugin outputs unsanitized. When any site visitor, including a logged-in administrator, navigates to that page, the stored script executes in their browser context, allowing the attacker to exfiltrate session cookies, perform authenticated actions under the victim's identity, or install additional malicious content.