Passster – Password Protect Pages and Content <= 4.3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Protection Meta Fields
- ID
- WPSEC-2026-2896
- Plugin
- Passster – Password Protect Pages and Content (content-protector)
- Affected
- all versions before 4.3.22
- Remediation
- Update to 4.3.22 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- Passster – Password Protect Pages and Content on WPSec AttackSurface
- Fix released
- Published
Description
The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post protection meta fields (such as passster_id, passster_headline, passster_placeholder, passster_button, passster_password and passster_redirect_url) in all versions up to, and including, 4.3.21. This is due to the passster_* post meta keys not being registered as protected, which lets them be written through WordPress core's Custom Fields feature, combined with insufficient escaping when the plugin concatenates the meta values into the [passster] shortcode it builds for protected posts. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
- https://wpsec.com/vuln/WPSEC-2026-2896/
- https://plugins.svn.wordpress.org/content-protector/tags/4.3.22/
- https://wordpress.org/plugins/content-protector/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS