CVE-2026-3639: 
WordPress vulnerability analysis and mitigation

CVE-2026-3639 is a Stored Cross-Site Scripting (XSS) vulnerability in the PPWP – Password Protect Pages plugin for WordPress, affecting all versions up to and including 1.9.21. The flaw arises from insufficient input sanitization and output escaping on user-supplied attributes within the plugin's ppwp shortcode. It was published on August 13, 2026, and assigned a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting). The root cause lies in the plugin's shortcode handler (class-ppw-shortcode.php, line 582) and its associated view template (view-ppw-restriced-content-form.php, line 18), which fail to properly sanitize or escape user-supplied shortcode attributes before rendering them in page output. An authenticated attacker with at minimum contributor-level access can embed malicious JavaScript within ppwp shortcode attributes in a post or page; the script executes in the browser of any user who subsequently visits the affected page (GitHub Advisory, Wordfence).

Successful exploitation allows an authenticated contributor (or higher-privileged user) to persistently inject arbitrary JavaScript into WordPress pages, which executes in the browsers of all subsequent visitors. This can lead to session hijacking, credential theft, redirection to malicious sites, or further client-side attacks against site visitors. The scope is changed (S:C in CVSS), meaning the injected script can affect resources beyond the plugin's own security boundary, impacting site visitors broadly (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, indicating a currently low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory, Wordfence).

1. Gain contributor-level access: Register or compromise a WordPress account with at least contributor-level privileges on the target site running PPWP – Password Protect Pages ≤ 1.9.21.
2. Create or edit a post/page: Navigate to the WordPress editor and create or edit a post or page where the ppwp shortcode can be inserted.
3. Inject malicious shortcode attribute: Insert a ppwp shortcode with a crafted attribute containing a JavaScript payload, for example: [ppwp attribute="\"onmouseover=\"alert(document.cookie)"]Protected content[/ppwp] or a similar unsanitized attribute that breaks out of the HTML context.
4. Publish the page: Save and publish the page so the injected shortcode is stored in the database.
5. Trigger execution: When any site visitor (including administrators) loads the affected page, the injected JavaScript executes in their browser, enabling session cookie theft, credential harvesting, or further malicious actions (GitHub Advisory, Wordfence).

• Logs: WordPress audit logs or server access logs showing contributor-level (or above) users creating or editing pages/posts containing ppwp shortcodes with unusual attribute values (e.g., event handlers like onerror, onload, onmouseover, or encoded JavaScript).
• File System / Database: WordPress wp_posts table entries containing ppwp shortcode attributes with JavaScript payloads or HTML event handler strings (e.g., <script>, javascript:, onerror=).
• Network: Outbound requests from visitor browsers to unexpected external domains shortly after loading pages containing ppwp shortcodes, potentially indicating data exfiltration (e.g., cookie theft via document.location redirects).
• Browser: Unexpected JavaScript alerts, redirects, or form submissions triggered when visiting pages protected by the PPWP plugin.

Update the PPWP – Password Protect Pages plugin to a version newer than 1.9.21 as soon as a patched release becomes available; the changeset between tags 1.9.19 and 1.9.20 may contain relevant fixes (GitHub Advisory). As an interim measure, restrict contributor-level and above access to only fully trusted users, and audit existing pages for unauthorized or suspicious ppwp shortcode modifications. If the plugin is not actively required, consider disabling or removing it until a confirmed patched version is available (Wordfence).