Live › vulnerability › CVE-2026-93293
The Password Protected WordPress plugin up to and including 2.8.4 has a bundled Freemius SDK that stores an unsanitized 'purchased_plan' request parameter in a site-wide admin notice. An authenticated subscriber can inject scripts that run in an administrator's browser when they view an admin page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Sites running the Password Protected WordPress plugin version 2.8.4 or earlier with the bundled Freemius SDK opt-in completed. Exploitation needs a logged-in account with at least subscriber access, and the payload fires when an administrator views an admin page such as their Profile page. Sites without the plugin, or with a fixed version, are not affected.
No product ranges from the sources yet.
wp-content/plugins/password-protected/No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's purchase-completion handler in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. Once the site's Freemius opt-in is complete (the normal state after an administrator clicks "Allow & Continue"), the handler processes the 'purchased_plan' request parameter on any wp-admin request from an authenticated user without any capability, nonce, or purchase validation, and stores it in a persistent, site-wide administrative notice. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts that execute automatically when an administrator views a standard admin page such as their Profile page.
This page as .md · .json · in your agent: get_signal("CVE-2026-93293")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.