PPWP – Password Protect Pages vulnerabilities

2 known vulnerabilities in PPWP – Password Protect Pages from Buildwps. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  PPWP – Password Protect Pages: Improper Neutralization of Input During Web Page Generation

  CVE-2026-116520Oct 31, 2026Buildwps

  The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / shortcode attribute desc_below_form (and placeholder as the marker-smuggling helper)' parameter in all versions up to, and including, 1.9.26

• 8.8 High severity

  PPWP – Password Protect Pages: Deserialization of Untrusted Data

  CVE-2026-0551Aug 23, 2026Buildwps

  The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'post_protection_roles' vulnerable parameter. This makes it possible for a