---
id: "CVE-2026-125454"
page: "https://infrastack.ai/live/CVE-2026-125454"
kind: "vulnerability"
aliases: ["CVE-2026-125454"]
title: "WordPress Passster plugin: stored XSS through versions 4.3.21"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "passster", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-11T13:17:21+00:00"
first_seen_at: "2026-11-11T13:27:14+00:00"
updated_at: "2026-11-11T13:29:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125454", "first_seen_at": "2026-11-11T13:27:14+00:00"}]
exploit_sources: []
---

# WordPress Passster plugin: stored XSS through versions 4.3.21

Link for people: https://infrastack.ai/live/CVE-2026-125454 (this .md is for agents)

The Passster content-protector plugin for WordPress has a stored cross-site scripting flaw in versions up to and including 4.3.21. An attacker who can store input in the plugin can run scripts in the browsers of visitors or administrators who view that content.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Passster version in the WordPress admin under Plugins, or in the plugin's main file header.
- Treat any version at or below `4.3.21` as affected, per the source.

## Timeline

- 2026-11-11T13:27:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125454

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Passster content-protector allows Stored XSS.This issue affects Passster: from n/a through 4.3.21.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_