These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The PPWP – Password Protect WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppwp' shortcode in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This vulnerability requires verification and updates to prevent potential Stored Cross-Site Scripting attacks, impacting defenders respon [truncated]
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18. This vulnerability allows authenticated attackers with Contributor-level access and above to inject a PHP Object via deserialization of untrusted input from the 'post_protection_roles' parameter. However, no known POP chain is present in the vulnerable software, limiti [truncated]
The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the can_access function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve a master-password and access any password-protected content.
The PPWP – Password Protect WordPress plugin is vulnerable to Insecure Direct Object Reference, allowing authenticated attackers with Contributor-level access to update passwords on protected posts. This vulnerability requires verification of patch deployment and access controls, as well as monitoring for suspicious activity. Affected WordPress installations using the PPWP plugin, especially those with Co [truncated]
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ppwp` shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages [truncated]