CVE-2026-125409: Passster <= 4.3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'metavalue' Parameter
The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'metavalue (metakeyinput=passsterid | passsterheadline)' parameter in all versions up to, and including, 4.3.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor can break out of the shortcode attribute context by embedding a ] character in the passsterid or passsterheadline meta value to prematurely close the opening shortcode tag, then append a [/passster] closing tag so that the trailing HTML payload is emitted verbatim by doshortcode() — bypassing the per-attribute escaping present inside rendershortcode() — and the script will also execute in an editor's or administrator's browser when they preview the Contributor's pending post, since filterthecontent() has no edit-permission capability gate.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Contributor-level access or higher can exploit it. The attacker needs to be able to create or edit content containing the affected Passster metadata values.
What is required for exploitation?
The attacker must supply a crafted passster_id or passster_headline metavalue containing a ] character to escape the shortcode attribute context, then add a [/passster] closing tag and HTML script payload. No victim interaction is required for injection, but the stored script runs when someone accesses the affected page.
Can administrators be affected even if the malicious post is not published?
Yes. An editor or administrator can trigger the script by previewing a Contributor's pending post, because the content filter does not require edit-permission checks before rendering the injected content.
How can I identify potentially affected content?
Review content created or editable by Contributor-level users for Passster passster_id or passster_headline values containing a ] character, especially where a closing [/passster] tag is followed by unexpected HTML or script content. Versions up to and including 4.3.21 are affected.