CVE-2026-93293 Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler

The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's purchase-completion handler in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. Once the site's Freemius opt-in is complete t...

CVE-2026-93293

The Password Protected plugin for WordPress (versions up to and including 2.8.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The issue exists in the bundled Freemius SDK 's purchase_completed handler due to insufficient input sanitization and output escaping. If a site has completed the...