CVE-2026-4025 lcweb-projects CVE debrief

Who should care

Users of the PrivateContent Free plugin for WordPress, particularly those with Contributor-level access and above, should be aware of this vulnerability and take necessary actions to protect their sites.

Technical summary

The vulnerability exists in the 'align' shortcode attribute of the [pc-login-form] shortcode in the PrivateContent Free plugin for WordPress. The attribute value flows from the shortcode through pc_login_form() to pc_static::form_align(), where it is directly concatenated into an HTML class attribute without esc_attr() or any escaping. This allows authenticated attackers to inject arbitrary web scripts. The issue affects all versions up to, and including, 1.2.0. To address this vulnerability, users should update the PrivateContent Free plugin to the latest version if available and implement Content Security Policy (CSP) to mitigate XSS attacks.

Defensive priority

Medium priority due to the CVSS score of 6.4 and the potential for authenticated attackers to inject scripts. This vulnerability requires immediate attention to prevent potential attacks. Users with Contributor-level access and above should be cautious when using the PrivateContent Free plugin for WordPress. It is recommended to implement Content Security Policy (CSP) and monitor for suspicious activity. Additionally, restricting access to the plugin's functionality for users with Contributor-level access and above can help mitigate the risk. Regularly reviewing and updating plugins and themes is also crucial to prevent similar vulnerabilities. Consider implementing web application firewall (WAF) rules to detect and prevent attacks. Furthermore, users should be aware of the potential risks associated with this vulnerability and take necessary actions to protect their sites. The PrivateContent Free plugin for WordPress has a Stored Cross-Site Scripting vulnerability via the 'align' shortcode attribute in the [pc-login-form] shortcode. This issue affects all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. The vulnerability exists in the 'align' shortcode attribute of the [pc-login-form] shortcode. The attribute value is directly concatenated into an HTML class attribute without proper escaping, allowing authenticated attackers to inject arbitrary web scripts. Users of the PrivateContent Free plugin for WordPress, particularly those with Contributor-level access and above, should be aware of this vulnerability and take necessary actions to protect their sites. To address this vulnerability, it is recommended to update the PrivateContent Free plugin to the latest version if available. Implementing Content Security Policy (CSP) can help mitigate XSS attacks. Monitoring for suspicious activity and implementing web application firewall (WAF) rules can also help prevent attacks. Restricting access to the plugin's functionality for users with Contributor-level access and above can help reduce the risk. Regularly reviewing and updating plugins and themes is crucial to prevent similar vulnerabilities. Consider implementing a

Recommended defensive actions

• Update the PrivateContent Free plugin to the latest version if available.
• Implement Content Security Policy (CSP) to mitigate XSS attacks.
• Monitor for suspicious activity and implement web application firewall (WAF) rules.
• Restrict access to the plugin's functionality for users with Contributor-level access and above.
• Regularly review and update plugins and themes to prevent similar vulnerabilities.

Evidence notes

The vulnerability was reported by [email protected] and is documented in various source references. The CVE record was published on 2026-04-08T10:16:00.813Z and last modified on 2026-07-24T20:10:00.147Z. Evidence is limited to reporter claims and CVE details. Defenders should verify affected deployments, review official advisories, and monitor for suspicious activity.

Official resources