Buildwps
Monthly
Stored XSS in the PPWP - Password Protect Pages WordPress plugin (all versions up to and including 1.9.21) allows authenticated contributors to inject persistent malicious scripts via unsanitized attributes in the 'ppwp' shortcode. Any user or administrator who subsequently loads an affected page will execute the injected script in their browser, enabling session hijacking, credential theft, or escalated site compromise. No public exploit code or CISA KEV listing is identified at time of analysis; however, the CVSS Scope:Changed rating reflects meaningful cross-origin impact on visiting users beyond the injecting contributor.
Insecure Direct Object Reference in the PPWP - Password Protect Pages WordPress plugin (all versions ≤ 1.9.20) allows any authenticated Contributor-level user to overwrite the password on any password-protected post site-wide, then access that previously restricted content. The vulnerability exists in the `ppw_free_set_password` AJAX handler, which accepts a user-controlled post identifier without verifying the requesting user's authorization over the target object (CWE-639). No public exploit or active exploitation (CISA KEV) has been identified at the time of analysis; a fix commit is available in the WordPress plugin repository.
Stored Cross-Site Scripting in the PPWP - Password Protect Pages WordPress plugin (all versions through 1.9.21) allows authenticated contributors to inject persistent malicious scripts via unsanitized `ppwp` shortcode attributes. Insufficient input sanitization and output escaping in the plugin's shortcode handler and view template enable payload persistence in the WordPress database, firing in the browsers of any subsequent visitor - including administrators - to affected pages. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Token bypass in the Prevent Direct Access - Protect WordPress Files plugin (versions ≤2.8.8.8) allows unauthenticated remote attackers to download any file the plugin is configured to protect. The `get_advance_file_by_url()` method in `includes/repository.php` performs token validation using a SQL `LIKE` clause without sanitizing input via `$wpdb->esc_like()`, meaning a request supplying `%` as the token value matches any record in the plugin's file table and causes the server to return the protected file. No public exploit has been identified at time of analysis, and the vendor-released fix is available in version 2.8.8.9.
Stored XSS in the PPWP - Password Protect Pages WordPress plugin (all versions up to and including 1.9.21) allows authenticated contributors to inject persistent malicious scripts via unsanitized attributes in the 'ppwp' shortcode. Any user or administrator who subsequently loads an affected page will execute the injected script in their browser, enabling session hijacking, credential theft, or escalated site compromise. No public exploit code or CISA KEV listing is identified at time of analysis; however, the CVSS Scope:Changed rating reflects meaningful cross-origin impact on visiting users beyond the injecting contributor.
Insecure Direct Object Reference in the PPWP - Password Protect Pages WordPress plugin (all versions ≤ 1.9.20) allows any authenticated Contributor-level user to overwrite the password on any password-protected post site-wide, then access that previously restricted content. The vulnerability exists in the `ppw_free_set_password` AJAX handler, which accepts a user-controlled post identifier without verifying the requesting user's authorization over the target object (CWE-639). No public exploit or active exploitation (CISA KEV) has been identified at the time of analysis; a fix commit is available in the WordPress plugin repository.
Stored Cross-Site Scripting in the PPWP - Password Protect Pages WordPress plugin (all versions through 1.9.21) allows authenticated contributors to inject persistent malicious scripts via unsanitized `ppwp` shortcode attributes. Insufficient input sanitization and output escaping in the plugin's shortcode handler and view template enable payload persistence in the WordPress database, firing in the browsers of any subsequent visitor - including administrators - to affected pages. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Token bypass in the Prevent Direct Access - Protect WordPress Files plugin (versions ≤2.8.8.8) allows unauthenticated remote attackers to download any file the plugin is configured to protect. The `get_advance_file_by_url()` method in `includes/repository.php` performs token validation using a SQL `LIKE` clause without sanitizing input via `$wpdb->esc_like()`, meaning a request supplying `%` as the token value matches any record in the plugin's file table and causes the server to return the protected file. No public exploit has been identified at time of analysis, and the vendor-released fix is available in version 2.8.8.9.