Vulnerabilities

TI-2025-05419 CVE-2025-5998 · GHSA-858f-824m-5p75

PPWP < 1.9.11 - Subscriber+ Access Bypass via REST API

MEDIUM 62

The PPWP – Password Protect Pages WordPress plugin before version 1.9.11 allows to put the site content behind a password authorization, however users with subscriber or greater roles can view content via the REST API.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00347 Published 2025-08-14 Fixed in 1.9.11

TI-2024-00575 CVE-2024-0620 · GHSA-mvj6-h82m-cjxf

PPWP – Password Protect Pages <= 1.8.9 - Protection Mechanism Bypass

LOW 31

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.9 via API.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00482 Published 2024-02-20 No fix listed CWE-200

TI-2022-04227 CVE-2022-4626 · GHSA-5jh4-frmf-hxhf

PPWP – WordPress Password Protect Page < 1.8.6 - Contributor+ Stored XSS in Shortcode

MEDIUM 58

The PPWP WordPress plugin before 1.8.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cr…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00649 Published 2023-02-06 Fixed in 1.8.6

Vulnerabilities

Filters

PPWP < 1.9.11 - Subscriber+ Access Bypass via REST API

PPWP – Password Protect Pages <= 1.8.9 - Protection Mechanism Bypass

PPWP – WordPress Password Protect Page < 1.8.6 - Contributor+ Stored XSS in Shortcode