# Passster – Password Protect Pages and Content <= 4.3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Protection Meta Fields

- **ID:** WPSEC-2026-2896
- **Plugin:** Passster – Password Protect Pages and Content (`content-protector`), https://wordpress.org/plugins/content-protector/
- **Affected versions:** all versions before 4.3.22
- **Fixed in:** 4.3.22 (Update to 4.3.22 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/content-protector
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2896/

## Description

The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post protection meta fields (such as passster_id, passster_headline, passster_placeholder, passster_button, passster_password and passster_redirect_url) in all versions up to, and including, 4.3.21. This is due to the passster_* post meta keys not being registered as protected, which lets them be written through WordPress core's Custom Fields feature, combined with insufficient escaping when the plugin concatenates the meta values into the [passster] shortcode it builds for protected posts. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

## References

- https://wpsec.com/vuln/WPSEC-2026-2896/
- https://plugins.svn.wordpress.org/content-protector/tags/4.3.22/
- https://wordpress.org/plugins/content-protector/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2896/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.