Stored Cross-Site Scripting in PrivateContent Free Plugin for WordPress

CVE-2026-4025

What is CVE-2026-4025?

The PrivateContent Free plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'align' shortcode attribute in the [pc-login-form]. All versions prior to and including 1.2.0 exhibit this flaw due to inadequate input validation and output escaping practices. The vulnerability arises when values are directly inserted into an HTML class attribute without utilizing the necessary escaping functions. As a result, authenticated users with Contributor access or higher can exploit this weakness to inject malicious web scripts, leading to potential exploitation when other users visit compromised pages.

References