CVE-2026-4025

The PrivateContent Free WordPress plugin (versions up to 1.2.0) contains a Stored Cross-Site Scripting (XSS) vulnerability in the [pc-login-form] shortcode's 'align' attribute. The flaw stems from insufficient input sanitization and output escaping, allowing malicious scripts to be injected directly into HTML class attributes without proper escaping functions. The vulnerability has a CVSS score of 6.4 (Medium severity) with a network-based attack vector requiring low complexity and authenticated user privileges at the Contributor level or above. While exploitation requires valid WordPress credentials, successful attacks enable arbitrary script execution that affects all users viewing the compromised page, presenting both integrity and confidentiality risks. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and shows minimal exploitation activity based on EPSS scoring. Community attention appears limited, with no public exploit code readily available. Organizations running vulnerable versions should prioritize patching to mitigate the risk of privilege escalation attacks from authenticated contributors.