WordPress plugin
Passster – Password Protect Pages and Content security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High0
- Medium24
- Low0
All Passster – Password Protect Pages and Content vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via 'metavalue' Parameter ≤4.3.21Update to 4.3.22 | CVE-2026-125409 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤4.3.21Update to 4.3.22 | CVE-2026-125454 | |
| Medium5.3 | Missing Authorization ≤4.3.20Update to 4.3.21 | CVE-2026-121574 | |
| Medium5.3 | Missing Authorization ≤4.3.18Update to 4.3.19 | CVE-2026-110896 | |
| Medium5.3 | Missing Authorization ≤4.3.13Update to 4.3.14 | CVE-2026-62114 | |
| Medium5.3 | Missing Authorization <4.3.9Update to 4.3.9 | CVE-2026-17559 | |
| Medium5.3 | Missing Authorization <4.3.6Update to 4.3.6 | CVE-2026-16604 | |
| Medium4.3 | Authenticated (Contributor+) Sensitive Information Exposure ≤4.3.6Update to 4.3.7 | CVE-2025-15674 | |
| Medium5.3 | Unauthenticated Non-Public Post Content Disclosure ≤4.3.5Update to 4.3.6 | CVE-2026-16602 | |
| Medium5.3 | Unauthenticated Category-Locked Content Disclosure ≤4.3.5Update to 4.3.6 | CVE-2026-16603 | |
| Medium5.3 | Unauthenticated Global Content Protection Bypass ≤4.2.25Update to 4.2.26 | CVE-2025-15490 | |
| Medium5.3 | Unauthenticated Protected Content Disclosure ≤4.2.23Update to 4.2.24 | CVE-2025-15489 | |
| Medium4.3 | Missing Authorization ≤4.2.25Update to 4.2.26 | CVE-2026-25036 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤4.2.24Update to 4.2.25 | CVE-2025-14865 | |
| Medium5.3 | Unauthenticated Information Exposure ≤4.2.19Update to 4.2.20 | CVE-2025-64218 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤4.2.18Update to 4.2.19 | CVE-2025-57926 | |
| Medium5.3 | Unauthenticated Content Restriction Bypass to Sensitive Information Exposure ≤4.2.10Update to 4.2.11 | CVE-2024-11282 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via content_protector Shortcode ≤4.2.6.4Update to 4.2.6.5 | CVE-2024-2026 | |
| Medium5.3 | Missing Authorization to Sensitive Information Exposure ≤4.2.6.2Update to 4.2.6.3 | CVE-2024-0616 | |
| Medium6.1 | Reflected Cross-Site Scripting via fs_request_get ≤1.9.2No patch available | CVE-2023-33999 | |
| Medium5.3 | Missing Authentication leading to Sensitive Information Disclosure (Private Post Leakage) ≤3.5.5.8Update to 3.5.5.9 | CVE-2021-24881 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤3.5.5.7Update to 3.5.5.8 | CVE-2021-24837 | |
| Medium5.3 | Insecure Password Storage to Sensitive Data Exposure ≤3.5.5.5.1Update to 3.5.5.5.2 | CVE-2022-3206 | |
| Medium6.3 | Missing Authorization Checks all versionsNo patch available | CVE-2022-4974 |
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'metavalue' Parameter
≤4.3.21Update to 4.3.22
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.3.21Update to 4.3.22
- Medium5.3Missing Authorization
≤4.3.20Update to 4.3.21
- Medium5.3Missing Authorization
≤4.3.18Update to 4.3.19
- Medium5.3Missing Authorization
≤4.3.13Update to 4.3.14
- Medium5.3Missing Authorization
<4.3.9Update to 4.3.9
- Medium5.3Missing Authorization
<4.3.6Update to 4.3.6
- Medium4.3Authenticated (Contributor+) Sensitive Information Exposure
≤4.3.6Update to 4.3.7
- Medium5.3Unauthenticated Non-Public Post Content Disclosure
≤4.3.5Update to 4.3.6
- Medium5.3Unauthenticated Category-Locked Content Disclosure
≤4.3.5Update to 4.3.6
- Medium5.3Unauthenticated Global Content Protection Bypass
≤4.2.25Update to 4.2.26
- Medium5.3Unauthenticated Protected Content Disclosure
≤4.2.23Update to 4.2.24
- Medium4.3Missing Authorization
≤4.2.25Update to 4.2.26
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤4.2.24Update to 4.2.25
- Medium5.3Unauthenticated Information Exposure
≤4.2.19Update to 4.2.20
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.2.18Update to 4.2.19
- Medium5.3Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
≤4.2.10Update to 4.2.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via content_protector Shortcode
≤4.2.6.4Update to 4.2.6.5
- Medium5.3Missing Authorization to Sensitive Information Exposure
≤4.2.6.2Update to 4.2.6.3
- Medium6.1Reflected Cross-Site Scripting via fs_request_get
≤1.9.2No patch available
- Medium5.3Missing Authentication leading to Sensitive Information Disclosure (Private Post Leakage)
≤3.5.5.8Update to 3.5.5.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.5.5.7Update to 3.5.5.8
- Medium5.3Insecure Password Storage to Sensitive Data Exposure
≤3.5.5.5.1Update to 3.5.5.5.2
- Medium6.3Missing Authorization Checks
all versionsNo patch available
Passster – Password Protect Pages and Content: common questions
Does Passster – Password Protect Pages and Content have known vulnerabilities?
Yes. VulnCrest Radar lists 24 known vulnerabilities in Passster – Password Protect Pages and Content: 24 medium. At least one is not fixed in the latest version.
How do I check which version of Passster – Password Protect Pages and Content I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Passster – Password Protect Pages and Content vulnerability?
CVE-2026-125409, published Nov 12, 2026: Passster <= 4.3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'metavalue' Parameter. Severity: Medium (CVSS 6.4).
Is any Passster – Password Protect Pages and Content vulnerability listed in CISA KEV?
No. None of the known Passster – Password Protect Pages and Content vulnerabilities is currently listed in the CISA KEV catalog.