What is the CVSS score of CVE-2026-3639?

CVE-2026-3639 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

PPWP Password Protect Pages CVE-2026-3639

EUVD-2026-57741 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Wordfence

GHSA-jgr2-qxr7-gw6v

WordPress XSS Wordpress Plugin Ppwp Password Protect Pages Buildwps

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

UI:R applied over the provided UI:N because stored XSS still requires a victim to navigate to the injected page; all other metrics - PR:L for contributor access, S:C for browser scope change - are consistent with the description.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 08:16 vuln.today

CVE Published

Aug 13, 2026 - 07:37 cve.org

MEDIUM 6.4

DescriptionCVE.org

The PPWP - Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the PPWP - Password Protect Pages WordPress plugin (all versions through 1.9.21) allows authenticated contributors to inject persistent malicious scripts via unsanitized ppwp shortcode attributes. Insufficient input sanitization and output escaping in the plugin's shortcode handler and view template enable payload persistence in the WordPress database, firing in the browsers of any subsequent visitor - including administrators - to affected pages. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) describes the root cause: the plugin's ppwp WordPress shortcode accepts user-supplied attributes that are rendered into page output without adequate sanitization or escaping. The two confirmed vulnerable code paths, identified by Wordfence and traceable via the WordPress.org Trac repository, are includes/services/class-ppw-shortcode.php at line 582 (the shortcode attribute handler) and includes/views/shortcode/view-ppw-restriced-content-form.php at line 18 (the template rendering those values). CPE cpe:2.3:a:buildwps:ppwp_-_password_protect_pages identifies the vendor and plugin. Because the variant is Stored XSS, the injected payload persists in the WordPress database and is served to every subsequent page visitor without further attacker interaction.

RemediationAI

Users should update the PPWP - Password Protect Pages plugin to any version released after 1.9.21; however, an exact confirmed patched release version is not independently verifiable from the available data. A changeset between versions 1.9.19 and 1.9.20 is referenced in the WordPress.org Trac repository (https://plugins.trac.wordpress.org/changeset?old_path=%2Fpassword-protect-page/tags/1.9.19&new_path=%2Fpassword-protect-page/tags/1.9.20) but does not confirm a complete fix for this specific CVE since 1.9.21 remains listed as affected. As a compensating control while awaiting a confirmed patch, administrators should audit and restrict contributor-level accounts - particularly on sites with open user registration - and manually inspect all pages using the ppwp shortcode for injected script content. Disabling ppwp shortcode processing is a more disruptive but effective mitigation, at the cost of losing password-protection functionality on those pages. Restricting the contributor role's ability to publish without review via an editorial workflow adds a meaningful barrier without breaking plugin functionality.