{"id":"CVE-2026-125409","kind":"vulnerability","aliases":["CVE-2026-125409"],"related":[],"title":"WordPress Passster plugin: stored script injection via shortcode meta fields","description":"The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'metavalue (metakeyinput=passster_id | passster_headline)' parameter in all versions up to, and including, 4.3.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor can break out of the shortcode attribute context by embedding a ] character in the passster_id or passster_headline meta value to prematurely close the opening shortcode tag, then append a [/passster] closing tag so that the trailing HTML payload is emitted verbatim by do_shortcode() — bypassing the per-attribute escaping present inside render_shortcode() — and the script will also execute in an editor's or administrator's browser when they preview the Contributor's pending post, since filter_the_content() has no edit-permission capability gate.","summary":"The Passster password-protection plugin for WordPress fails to sanitize the passster_id and passster_headline meta values, letting a contributor store a script that runs for any visitor or editor who opens the affected page. An attacker with contributor access can run script in other users' browsers, including administrators previewing a pending post.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","passster","self-hosted","wordpress"],"not_affected_if":["fixed-version","no-contributor-accounts","plugin-not-installed"],"how_to_check":"- Check whether the Passster plugin is installed and active in the WordPress admin under Plugins.\n- Check the installed Passster version; versions up to and including `4.3.21` are affected.","fix":null,"status":"open","published_at":"2026-11-13T10:17:28+00:00","first_seen_at":"2026-11-13T10:47:11+00:00","triaged_at":"2026-11-13T10:55:07+00:00","updated_at":"2026-11-13T10:55:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:55:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WordPress Passster plugin: stored script injection via shortcode meta fields","impact":"medium","summary":"The Passster password-protection plugin for WordPress fails to sanitize the passster_id and passster_headline meta values, letting a contributor store a script that runs for any visitor or editor who opens the affected page. An attacker with contributor access can run script in other users' browsers, including administrators previewing a pending post.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","passster","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"script runs in administrator browsers, enabling account takeover","analyst_note":"Find the patched Passster version and vendor advisory from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-125409, since no fixed version is given here.","how_to_check":"- Check whether the Passster plugin is installed and active in the WordPress admin under Plugins.\n- Check the installed Passster version; versions up to and including `4.3.21` are affected.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-contributor-accounts","fixed-version"],"who_is_affected":"Sites running the Passster plugin at version 4.3.21 or earlier where contributors can create or edit posts. The flaw needs a contributor-level account, and the script also runs when an editor or administrator previews the pending post. Sites without Passster, or where only trusted editors write content, have less exposure.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000774,"input_tokens":4801,"output_tokens":587,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125409':13A,16A '-2026':12A,15A '/passster':185C '4.3.21':112C 'access':64B,132C,148C 'administr':73B,221C 'affect':58B 'also':214C 'append':183C 'arbitrari':137C 'attack':61B,127C 'attribut':160C,204C 'authent':126C 'break':155C 'browser':71B,223C 'bypass':200C 'capabl':241C 'charact':165C 'close':177C,186C 'content':84C,235C 'context':161C 'contributor':44B,63B,130C,153C,228C 'contributor-level':129C 'cross':93C 'cross-sit':92C 'cve':11A,14A 'due':113C 'edit':239C 'edit-permiss':238C 'editor':54B,218C 'embed':163C 'emit':195C 'escap':120C,205C 'execut':144C,215C 'fail':31B 'field':10A 'filter':233C 'gate':242C 'headlin':39B,103C,172C 'host':21B 'html':192C 'id':36B,101C,169C 'includ':72B,111C 'inject':6A,136C,150C 'input':116C 'insid':207C 'insuffici':115C 'let':42B 'level':131C 'make':122C 'meta':9A,40B,173C 'metakeyinput':99C 'metavalu':98C 'open':56B,179C 'output':119C 'packag':17B 'page':59B,82C,141C,151C 'paramet':104C 'passster':2A,18B,24B,35B,38B,79C,100C,102C,168C,171C 'password':26B,80C 'password-protect':25B 'payload':193C 'pend':76B,230C 'per':203C 'per-attribut':202C 'permiss':240C 'plugin':3A,28B,85C 'possibl':124C 'post':77B,231C 'prematur':176C 'present':206C 'preview':74B,226C 'protect':27B,81C 'render':208C 'run':49B,66B 'sanit':33B,117C 'script':5A,47B,67B,95C,139C,212C 'self':20B 'self-host':19B 'shortcod':8A,159C,180C,199C,209C 'sinc':232C 'site':94C 'store':4A,45B,91C 'tag':181C,187C 'trail':191C 'user':70B,147C 'valu':41B,174C 'verbatim':196C 'version':107C 'via':7A,96C 'visitor':52B 'vulner':89C 'web':138C 'whenev':145C 'wordpress':1A,22B,30B,87C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Passster plugin at version 4.3.21 or earlier where contributors can create or edit posts. The flaw needs a contributor-level account, and the script also runs when an editor or administrator previews the pending post. Sites without Passster, or where only trusted editors write content, have less exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","passster","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-125409':13A,16A '-2026':12A,15A 'cve':11A,14A 'field':10A 'inject':6A 'meta':9A 'passster':2A 'plugin':3A 'script':5A 'shortcod':8A 'store':4A 'via':7A 'wordpress':1A","search_b":"'access':64B 'administr':73B 'affect':58B 'attack':61B 'browser':71B 'contributor':44B,63B 'editor':54B 'fail':31B 'headlin':39B 'host':21B 'id':36B 'includ':72B 'let':42B 'meta':40B 'open':56B 'packag':17B 'page':59B 'passster':18B,24B,35B,38B 'password':26B 'password-protect':25B 'pend':76B 'plugin':28B 'post':77B 'preview':74B 'protect':27B 'run':49B,66B 'sanit':33B 'script':47B,67B 'self':20B 'self-host':19B 'store':45B 'user':70B 'valu':41B 'visitor':52B 'wordpress':22B,30B","search_c":"'/passster':185C '4.3.21':112C 'access':132C,148C 'administr':221C 'also':214C 'append':183C 'arbitrari':137C 'attack':127C 'attribut':160C,204C 'authent':126C 'break':155C 'browser':223C 'bypass':200C 'capabl':241C 'charact':165C 'close':177C,186C 'content':84C,235C 'context':161C 'contributor':130C,153C,228C 'contributor-level':129C 'cross':93C 'cross-sit':92C 'due':113C 'edit':239C 'edit-permiss':238C 'editor':218C 'embed':163C 'emit':195C 'escap':120C,205C 'execut':144C,215C 'filter':233C 'gate':242C 'headlin':103C,172C 'html':192C 'id':101C,169C 'includ':111C 'inject':136C,150C 'input':116C 'insid':207C 'insuffici':115C 'level':131C 'make':122C 'meta':173C 'metakeyinput':99C 'metavalu':98C 'open':179C 'output':119C 'page':82C,141C,151C 'paramet':104C 'passster':79C,100C,102C,168C,171C 'password':80C 'payload':193C 'pend':230C 'per':203C 'per-attribut':202C 'permiss':240C 'plugin':85C 'possibl':124C 'post':231C 'prematur':176C 'present':206C 'preview':226C 'protect':81C 'render':208C 'sanit':117C 'script':95C,139C,212C 'shortcod':159C,180C,199C,209C 'sinc':232C 'site':94C 'store':91C 'tag':181C,187C 'trail':191C 'user':147C 'valu':174C 'verbatim':196C 'version':107C 'via':96C 'vulner':89C 'web':138C 'whenev':145C 'wordpress':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125409","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125409","severity":null,"published_at":"2026-11-13T10:17:28+00:00","modified_at":"2026-11-13T10:17:28+00:00","first_seen_at":"2026-11-13T10:47:11+00:00","fetched_at":"2026-11-13T10:47:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}