Vendor

lcweb-projects vulnerabilities

1 published CVE affecting lcweb-projects, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total: 1
Critical: 0
High: 0
Medium: 1
Low: 0
Unscored: 0
CISA KEV: 0

Atom feed of lcweb-projects alerts

Products

PrivateContent Free 1

Latest lcweb-projects CVEs

Newest publication first

CVE-2026-4025 PrivateContent Free <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute
Published 2026-04-08

MediumCVSS 6.4

The PrivateContent Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' shortcode attribute in the [pc-login-form] shortcode in all versions up to, and including, 1.2.0. This is due to insufficient input sanitization and output escaping on the 'a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.

lcweb-projects vulnerabilities

Products

Latest lcweb-projects CVEs

CVE-2026-4025 PrivateContent Free <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute