CVE-2026-125454: WordPress Passster plugin <= 4.3.21 - Cross Site Scripting (XSS) vulnerability

Q: What level of access does an attacker need to exploit this issue?

The listed vector requires low-privileged access (PR:L) and user interaction (UI:R). It is remotely reachable over the network (AV:N) and has low attack complexity (AC:L).

Q: What is the potential impact of successful exploitation?

Successful exploitation can affect confidentiality, integrity, and availability at low impact levels. The scope is changed (S:C), meaning the impact can extend beyond the vulnerable plugin's authorization scope.

Q: Which Passster versions are affected?

Passster versions through 4.3.21 are affected. The earliest affected version is not specified.

Published Nov 11, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Passster content-protector allows Stored XSS.This issue affects Passster: from n/a through 4.3.21.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Passster plugin to a version that resolves this vulnerability.
Fixed in 4.3.22

Event History

Nov 11, 2026

CVE Published

via MITRE·12:59 PM

Data Sourced

via MITRE·12:59 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The listed vector requires low-privileged access (PR:L) and user interaction (UI:R). It is remotely reachable over the network (AV:N) and has low attack complexity (AC:L).

What is the potential impact of successful exploitation?

Successful exploitation can affect confidentiality, integrity, and availability at low impact levels. The scope is changed (S:C), meaning the impact can extend beyond the vulnerable plugin's authorization scope.

Which Passster versions are affected?

Passster versions through 4.3.21 are affected. The earliest affected version is not specified.

CVE-2026-125454: WordPress Passster plugin <= 4.3.21 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the potential impact of successful exploitation?

Which Passster versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the potential impact of successful exploitation?

Which Passster versions are affected?