CVE-2026-125409 · Package
NO FIX YET
The Passster password-protection plugin for WordPress fails to sanitize the passster_id and passster_headline meta values, letting a contributor store a script that runs for any visitor or editor who opens the affected page. An attacker with contributor access can run script in other users' browsers, including administrators previewing a pending post.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Passster plugin at version 4.3.21 or earlier where contributors can create or edit posts. The flaw needs a contributor-level account, and the script also runs when an editor or administrator previews the pending post. Sites without Passster, or where only trusted editors write content, have less exposure.
Not affected if fixed-version, no-contributor-accounts, plugin-not-installed
Who cares passster, self-hosted, wordpress
4.3.21 are affected.No fix yet, per the sources.
The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'metavalue (metakeyinput=passster_id | passster_headline)' parameter in all versions up to, and including, 4.3.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor can break out of the shortcode attribute context by embedding a ] character in the passster_id or passster_headline meta value to prematurely close the opening shortcode tag, then append a [/passster] closing tag so that the trailing HTML payload is emitted verbatim by do_shortcode() — bypassing the per-attribute escaping present inside render_shortcode() — and the script will also execute in an editor's or administrator's browser when they preview the Contributor's pending post, since filter_the_content() has no edit-permission capability gate.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.