Plugin icon

PPWP – Password Protect Pages

password-protect-page

Vulnerabilities:

10

Last Updated:

August 12, 2026

Active Installs:

30000

Published
Title
Fixed in
CVSS
Published
2026-08-22
Title
PPWP – Password Protect Pages < 1.9.19 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles
Fixed in
Fixed in 1.9.19
CVSS
7.2 (high)
Published
2026-08-18
Title
PPWP – Password Protect Pages < 1.9.16 - Contributor+ Master Password Disclosure via can_access
Fixed in
Fixed in 1.9.16
CVSS
2.7 (low)
Published
2026-08-15
Title
Password Protect WordPress Lite < 1.9.21 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password Update
Fixed in
Fixed in 1.9.21
CVSS
2.7 (low)
Published
2026-08-12
Title
PPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Fixed in
No known fix
CVSS
5.5 (medium)
Published
2026-06-26
Title
PPWP – Password Protect Pages < 1.9.20 - Authenticated (Contributor+) Insecure Direct Object Reference
Fixed in
Fixed in 1.9.20
CVSS
2.7 (low)
Published
2026-03-23
Title
PPWP – Password Protect Pages < 1.9.16 - Missing Authorization
Fixed in
Fixed in 1.9.16
CVSS
4.3 (medium)
Published
2025-07-24
Title
PPWP < 1.9.11 - Subscriber+ Access Bypass via REST API
Fixed in
Fixed in 1.9.11
CVSS
4.3 (medium)
Published
2024-12-16
Title
PPWP – Password Protect Pages < 1.9.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
Fixed in
Fixed in 1.9.6
CVSS
5.3 (medium)
Published
2024-02-07
Title
PPWP – Password Protect Pages < 1.9.0 - Protection Mechanism Bypass
Fixed in
Fixed in 1.9.0
CVSS
5.3 (medium)
Published
2023-01-10
Title
PPWP – WordPress Password Protect Page < 1.8.6 - Contributor+ Stored XSS in Shortcode
Fixed in
Fixed in 1.8.6
CVSS
6.8 (medium)