CVE-2026-4025: 
WordPress vulnerability analysis and mitigation

CVE-2026-4025 is a Stored Cross-Site Scripting (XSS) vulnerability in the PrivateContent Free plugin for WordPress, affecting all versions up to and including 1.2.0. The flaw resides in the align shortcode attribute of the [pc-login-form] shortcode, where insufficient input sanitization allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts. It was published on April 8, 2026, with a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically insufficient output escaping. The align attribute value provided in the [pc-login-form] shortcode flows through pc_login_form() to pc_static::form_align(), where it is directly concatenated into an HTML class attribute without applying WordPress's esc_attr() function or any equivalent escaping (GitHub Advisory). The vulnerable code paths are visible in pc_static.php at line 764, shortcodes.php at line 10, and public_api.php at line 413 of the plugin's 1.2.0 release (GitHub Advisory). Exploitation requires a network-accessible WordPress instance and an authenticated account with at least Contributor-level privileges.

Successful exploitation allows an attacker to persistently inject malicious JavaScript into any page containing the [pc-login-form] shortcode, which executes in the browser of any user who visits the affected page. This can lead to session hijacking, credential theft, malware distribution, or page defacement. The vulnerability has a Changed scope in CVSS terms, meaning the injected scripts can affect resources beyond the plugin itself, such as the broader WordPress site and its visitors (GitHub Advisory, Wordfence).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.042% (17th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify WordPress sites running the PrivateContent Free plugin version 1.2.0 or earlier, using tools like WPScan or by inspecting page source for plugin indicators.
2. Obtain Contributor access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Create or edit a post/page: Navigate to the WordPress editor and insert the [pc-login-form] shortcode with a malicious align attribute, e.g., [pc-login-form align="evil\" onmouseover=\"alert(document.cookie)"] or a crafted class-breaking payload.
4. Publish the content: Submit the post or page for publication (or save as draft if auto-published by an editor/admin).
5. Trigger execution: When any site visitor loads the page containing the injected shortcode, the unsanitized align value is rendered into the HTML class attribute, causing the injected script to execute in the victim's browser, enabling session token theft or further attacks (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/post.php or the REST API containing [pc-login-form] shortcodes with unusual align attribute values (e.g., containing <script>, javascript:, or event handlers like onerror, onmouseover).
• File System: Unexpected modifications to post content in the WordPress database (wp_posts table) containing malicious shortcode payloads in the post_content field.
• Network: Outbound requests from victim browsers to attacker-controlled domains following page visits, potentially visible in web server or proxy logs as referrals from the affected WordPress page.
• Process/Application: WordPress audit log entries (if a logging plugin is installed) showing Contributor-level users creating or editing pages with the [pc-login-form] shortcode shortly before user complaints of anomalous browser behavior.

Update the PrivateContent Free plugin to a version beyond 1.2.0 that includes the fix applying esc_attr() to the align attribute before HTML output (GitHub Advisory). The patch changeset is available in the WordPress plugin repository. As interim mitigations, restrict Contributor-level (and above) access to only fully trusted users, audit existing pages for suspicious [pc-login-form] shortcode align values, and consider deploying a Web Application Firewall (WAF) to filter XSS payloads (Wordfence).

Wordfence included CVE-2026-4025 in their weekly WordPress vulnerability report for the period of April 6–12, 2026, as part of routine disclosure coverage (Wordfence Blog). No significant independent researcher commentary or broader media coverage has been identified for this vulnerability.