PT-2026-31286 · WordPress · Privatecontent Free

Published 2026-04-08 · Updated 2026-04-12 · CVE-2026-4025

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PrivateContent Free versions up to and including 1.2.0

Description The PrivateContent Free plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'align' shortcode attribute within the [pc-login-form] shortcode. This occurs due to inadequate input sanitization and output escaping on the align attribute. The attribute value is passed from the shortcode through the pc login form() function to the pc static::form align() function, where it is directly added to an HTML class attribute without proper escaping. This allows authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages, which will execute when a user visits the affected page.

Recommendations Update PrivateContent Free to a version later than 1.2.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4025

Affected Products

Privatecontent Free

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-4025 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a9ed2943-e108-49e3-ba16-f74ce3136bde?source=cve · Note
• https://plugins.trac.wordpress.org/browser/privatecontent-free/tags/1.2.0/main_includes/shortcodes.php#L10 · Note
• https://plugins.trac.wordpress.org/browser/privatecontent-free/trunk/classes/pc_static.php#L764 · Note
• https://plugins.trac.wordpress.org/browser/privatecontent-free/tags/1.2.0/classes/pc_static.php#L764 · Note
• https://t.me/cveNotify/158436 · Telegram Post
• https://plugins.trac.wordpress.org/browser/privatecontent-free/trunk/main_includes/shortcodes.php#L10 · Note
• https://t.me/CVEtracker/50038 · Telegram Post
• https://twitter.com/CVEnew/status/2043295676176413057 · Twitter Post
• https://plugins.trac.wordpress.org/browser/privatecontent-free/tags/1.2.0/main_includes/public_api.php#L413 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3497358%40privatecontent-free&new=3497358%40privatecontent-free&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/privatecontent-free/trunk/main_includes/public_api.php#L413 · Note