CVE-2026-116520 buildwps CVE debrief

Who should care

Defenders responsible for WordPress installations using the PPWP – Password Protect Pages plugin should assess exposure and prioritize verification of unauthenticated user comment settings.

Why it matters

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting, allowing unauthenticated attackers to inject arbitrary web scripts. Defenders should prioritize verifying exposure and consider upgrading to a patched version.

• Unauthenticated attackers can inject arbitrary web scripts in pages
• Injected scripts execute when a user accesses an injected page
• Defenders must verify exposure of WordPress installations
• Remediation priority is high due to HIGH CVSS severity

Technical summary

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / shortcode attribute desc_below_form (and placeholder as the marker-smuggling helper)' parameter in all versions up to, and including, 1.9.26 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Defensive priority

Defenders should prioritize verifying exposure of WordPress installations using the PPWP – Password Protect Pages plugin, especially if unauthenticated user comments are allowed.

Recommended defensive actions

• Verify exposure of WordPress installations using the PPWP – Password Protect Pages plugin
• Check if unauthenticated user comments are allowed
• Consider upgrading to a patched version of the plugin
• Monitor for suspicious activity on WordPress installations
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.2 and HIGH severity. The vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.