plugin
20 known security issues reported for the Wp Private Content Plus WordPress plugin. Most recent disclosed Oct 13, 2025.
Running Wp Private Content Plus on your site? Check whether your installed version is affected.
Scan your site free[en] The WP Private Content Plus through 3.6.2 provides a global content protection feature that requires a password. However, the access control check is based only on the presence of an unprotected client-side cookie. As a result, an unauthenticated attacker can completely bypass the password protection by manually s...
The WP Private Content Plus plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 3.6.2. This is due to the plugin relying on an easily settable cookie to provide access to password protected posts. This makes it possible for unauthenticated attackers to view private content w...
The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'validate_restrictions' function. This makes it possible for unauthenticated attackers to extract sensitive data including the content of resticted posts on archive and fe...
[en] The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.1 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level rol...
The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.1 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles su...
[en] The WP Private Content Plus plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 3.6. This is due to the plugin not properly restricting access to posts via the REST API when a page has been made private. This makes it possible for unauthenticated attackers to view pro...
The WP Private Content Plus plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 3.6. This is due to the plugin not properly restricting access to posts via the REST API when a page has been made private. This makes it possible for unauthenticated attackers to view protecte...
[en] The WP Private Content Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is due to missing or incorrect nonce validation on the save_groups() function. This makes it possible for unauthenticated attackers to add new group members via a forged request...
The WP Private Content Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Admin Settings in versions up to, and including, 3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to in...
The WP Private Content Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Admin Settings in versions up to, and including, 3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to in...
The WP Private Content Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is due to missing or incorrect nonce validation on the save_groups() function. This makes it possible for unauthenticated attackers to add new group members via a forged request grant...
Cross-Site Request Forgery (CSRF) vulnerability found in WordPress WP Private Content Plus plugin (versions <= 3.1).
[en] The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions.
The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions.
Unauthenticated Options Change vulnerability found in WordPress WP Private Content Plus plugin (versions <= 1.31).
The WP Private Content Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This makes it possible for unauthenticated attackers to create members via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Over 70 plugins and themes were vulnerable to Cross-Site Request Forgery due to improperly implemented nonce protection that could be bypassed.
The plugin allowed requests without the wppcp_backend_group_add_new_member_nonce POST parameter to bypass the CSRF check. This could lead to attackers making a logged in users add an arbitrary user to a group via a CSRF attack
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free