Input validation vulnerability in Password Protected 2.6.2

The Password Protected plugin for WordPress is vulnerable to a security risk called “Stored Cross-Site Scripting”. This vulnerability affects versions of the plugin up to and including version 2.6.2. It is possible for someone with administrator-level access to inject malicious code into webpages, which will execute when a user visits those pages. The vulnerability only affects WordPress installations that are part of a multi-site network, or those that have disabled a feature called “unfiltered_html”.