Password Protected Protect Your Site Content With A Password
Monthly
Stored cross-site scripting in the Password Protected WordPress plugin (versions up to and including 2.8.4) lets any authenticated subscriber-level user inject arbitrary script into a persistent, site-wide administrative notice by supplying the 'purchased_plan' parameter, because the bundled Freius SDK purchase-completion handler performs no capability, nonce, or purchase validation once the plugin's Freemius opt-in is complete. The injected script then executes automatically when an administrator loads a routine admin page such as their Profile page. No confirmed active exploitation or verified working exploit code is reported at time of analysis; this is a genuine but moderate-priority issue rather than a drop-everything emergency.
Stored cross-site scripting in the Password Protected WordPress plugin (versions up to and including 2.8.4) lets any authenticated subscriber-level user inject arbitrary script into a persistent, site-wide administrative notice by supplying the 'purchased_plan' parameter, because the bundled Freius SDK purchase-completion handler performs no capability, nonce, or purchase validation once the plugin's Freemius opt-in is complete. The injected script then executes automatically when an administrator loads a routine admin page such as their Profile page. No confirmed active exploitation or verified working exploit code is reported at time of analysis; this is a genuine but moderate-priority issue rather than a drop-everything emergency.