CVE-2026-3639

Publié : 13 août 2026

Modifié : 13 août 2026

Score CVSS

6.4

MEDIUM

Description détaillée

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ppwp` shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Références et Patchs

https://plugins.trac.wordpress.org/browser/password-protect-page/tags/1.9.15/includes/services/class-ppw-shortcode.php#L582 https://plugins.trac.wordpress.org/browser/password-protect-page/tags/1.9.15/includes/views/shortcode/view-ppw-restriced-content-form.php#L18 https://plugins.trac.wordpress.org/browser/password-protect-page/trunk/includes/services/class-ppw-shortcode.php#L582 https://plugins.trac.wordpress.org/browser/password-protect-page/trunk/includes/views/shortcode/view-ppw-restriced-content-form.php#L18 https://plugins.trac.wordpress.org/changeset?old_path=%2Fpassword-protect-page/tags/1.9.19&new_path=%2Fpassword-protect-page/tags/1.9.20 https://www.wordfence.com/threat-intel/vulnerabilities/id/7fa5206e-8888-4872-b4bd-91fe5628498c?source=cve

Dernières Vulnérabilités

CVE-2026-11840

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection.

VOIR DÉTAILS

CVE-2026-18622

Foxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified, including alterations to appearance, coordinates, or field duplication. This may mislead users into trusting tampered documents, since the UI cannot accurately reflect the actual integrity status of signatures.

VOIR DÉTAILS

CVE-2026-18146

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the browser of an administrator (or any user with the Fluent Forms entry-viewing capability) when they view the form's entry Submission Logs in the WordPress admin dashboard. Exploitation requires that a site administrator or Fluent Forms manager has configured an email notification whose subject or static (direct) Send To value references an attacker-influenced Smartcode such as an input_password field value, a cookie value, or submission.response.

VOIR DÉTAILS