60 matches found
CVE-2025-10005
The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppwfreesetpassword AJAX action due to missing validation on a user controlled key. This makes it...
CVE-2025-10005
The CVE-2025-10005 entry describes a vulnerability in the PPWP – Password Protect WordPress plugin (WordPress). An Insecure Direct Object Reference exists in all versions up to and including 1.9.20 via the ppw_free_set_password AJAX action, caused by missing validation on a user-controlled key. T...
EUVD-2025-210731
The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppwfreesetpassword AJAX action due to missing validation on a user controlled key. This makes it...
CVE-2025-10005
The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppwfreesetpassword AJAX action due to missing validation on a user controlled key. This makes it...
CVE-2025-10005: Authorization Bypass Through User-Controlled Key
The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppwfreesetpassword AJAX action due to missing validation on a user controlled key. This makes it...
PT-2026-73079
Name of the Vulnerable Software and Affected Versions PPWP – Password Protect WordPress versions prior to 1.9.21 Description An Insecure Direct Object Reference IDOR exists in the ppw free set password AJAX action. This issue occurs because of missing validation on a user-controlled key, allowing...
WordPress PPWP - Password Protect Pages plugin <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability
WordPress PPWP - Password Protect Pages plugin = 1.9.21 - Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Attributes vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin PPWP versions = 1.9.21...
CVE-2026-3639
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...
CVE-2026-3639 PPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...
CVE-2026-3639
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...
CVE-2026-3639 PPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...
EUVD-2026-57741
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...
CVE-2026-3639
CVE-2026-3639 : The PPWP – Password Protect Pages plugin for WordPress is vulnerable toStored Cross-Site Scripting via the plugin’s ppwp shortcode attributes in all versions up to and including 1.9.21, due to insufficient input sanitization and output escaping on user-supplied attributes. Authent...
CVE-2026-3639: Improper Neutralization of Input During Web Page Generation
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...
PT-2026-71398
Name of the Vulnerable Software and Affected Versions PPWP – Password Protect Pages versions prior to 1.9.22 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes within the ppwp shortcode. This allows authenticated...
MINI-58FJ-3GVG-PPWP
Bulletin has no description...
CVE-2026-57634
Contributor Insecure Direct Object References IDOR in PPWP = 1.9.19 versions...
CVE-2026-57634
This entry documents an IDOR vulnerability in the WordPress PPWP plugin (versions
WordPress PPWP plugin <= 1.9.19 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin PPWP versions = 1.9.19...