{"id":"CVE-2026-125454","kind":"vulnerability","aliases":["CVE-2026-125454"],"related":[],"title":"WordPress Passster plugin: stored XSS through versions 4.3.21","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Passster content-protector allows Stored XSS.This issue affects Passster: from n/a through 4.3.21.","summary":"The Passster content-protector plugin for WordPress has a stored cross-site scripting flaw in versions up to and including 4.3.21. An attacker who can store input in the plugin can run scripts in the browsers of visitors or administrators who view that content.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","passster","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Passster version in the WordPress admin under Plugins, or in the plugin's main file header.\n- Treat any version at or below `4.3.21` as affected, per the source.","fix":null,"status":"open","published_at":"2026-11-11T13:17:21+00:00","first_seen_at":"2026-11-11T13:27:14+00:00","triaged_at":"2026-11-11T13:29:16+00:00","updated_at":"2026-11-11T13:29:16+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T13:29:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Passster plugin: stored XSS through versions 4.3.21","impact":"medium","summary":"The Passster content-protector plugin for WordPress has a stored cross-site scripting flaw in versions up to and including 4.3.21. An attacker who can store input in the plugin can run scripts in the browsers of visitors or administrators who view that content.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","passster","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker scripts run in visitors' or admins' browsers on the site","analyst_note":"Confirm the fixed version and which input is stored unescaped; the NVD entry gives no fixed version.","how_to_check":"- Check the installed Passster version in the WordPress admin under Plugins, or in the plugin's main file header.\n- Treat any version at or below `4.3.21` as affected, per the source.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WordPress Passster content-protector plugin at version 4.3.21 or earlier. The sources do not state which input fields are involved or who must be able to submit content, so the exact exposure is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000706,"input_tokens":4538,"output_tokens":504,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125454':11A,14A '-2026':10A,13A '4.3.21':8A,43B,96C 'administr':62B 'affect':91C 'allow':87C 'attack':45B 'browser':58B 'chill':82C 'content':24B,66B,85C 'content-protector':23B,84C 'cross':33B,76C 'cross-sit':32B,75C 'cve':9A,12A 'flaw':36B 'generat':74C 'host':19B 'improp':67C 'includ':42B 'input':49B,70C 'issu':90C 'n/a':94C 'neutral':68C 'packag':15B 'page':73C 'passster':2A,16B,22B,83C,92C 'plugin':3A,26B,52B 'protector':25B,86C 'run':54B 'script':35B,55B,78C 'self':18B 'self-host':17B 'site':34B,77C 'store':4A,31B,48B,88C 'version':7A,38B 'view':64B 'visitor':60B 'vulner':79C 'web':72C 'wordpress':1A,20B,28B 'wp':81C 'xss':5A 'xss.this':89C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WordPress Passster content-protector plugin at version 4.3.21 or earlier. The sources do not state which input fields are involved or who must be able to submit content, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","passster","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-125454':11A,14A '-2026':10A,13A '4.3.21':8A 'cve':9A,12A 'passster':2A 'plugin':3A 'store':4A 'version':7A 'wordpress':1A 'xss':5A","search_b":"'4.3.21':43B 'administr':62B 'attack':45B 'browser':58B 'content':24B,66B 'content-protector':23B 'cross':33B 'cross-sit':32B 'flaw':36B 'host':19B 'includ':42B 'input':49B 'packag':15B 'passster':16B,22B 'plugin':26B,52B 'protector':25B 'run':54B 'script':35B,55B 'self':18B 'self-host':17B 'site':34B 'store':31B,48B 'version':38B 'view':64B 'visitor':60B 'wordpress':20B,28B","search_c":"'4.3.21':96C 'affect':91C 'allow':87C 'chill':82C 'content':85C 'content-protector':84C 'cross':76C 'cross-sit':75C 'generat':74C 'improp':67C 'input':70C 'issu':90C 'n/a':94C 'neutral':68C 'page':73C 'passster':83C,92C 'protector':86C 'script':78C 'site':77C 'store':88C 'vulner':79C 'web':72C 'wp':81C 'xss.this':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125454","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125454","severity":null,"published_at":"2026-11-11T13:17:21+00:00","modified_at":"2026-11-11T13:17:22+00:00","first_seen_at":"2026-11-11T13:27:14+00:00","fetched_at":"2026-11-11T13:27:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}