Passster WordPress plugin: Stored cross-site scripting (XSS)
Summary
The WordPress plugin Passster (slug content-protector), used to password-protect pages and content, contains a stored cross-site scripting vulnerability in versions up to and including 4.3.21. An attacker with Contributor-level access can store malicious scripts that run in the browsers of other users who view the affected content. Exploitation requires that a user, such as an editor or administrator, opens or interacts with the crafted content, and the impact on each of confidentiality, integrity and availability is rated low.
Affected
- Passster WordPress plugin (WP Chill), versions up to and including 4.3.21
- Required privilege according to Patchstack: Contributor
Fixed in
- Patchstack and the official CVE record name version 4.3.22 as the patched version.
- At the time of writing, the current WordPress.org release is 4.3.21, so the fix could not be confirmed on the plugin download page.
Workaround
- No vendor workaround confirmed.
- Limit Contributor-or-higher accounts and remove unused ones.
- Review existing content that uses the Passster shortcode for unexpected script or HTML.
- Consider a web application firewall or virtual patching if available.
Exploitation
- No evidence of active exploitation found at the time of research.
- KEV status: not listed.
- No public proof of concept found; the CVE was published on 11 November 2026.
- NVD status is Deferred, so the scoring may change.
Our recommendation
- Identify all WordPress sites running Passster.
- Update to version 4.3.22 or later as soon as it is available on WordPress.org.
- Until then, restrict Contributor and higher roles to trusted people, and review content that uses the Passster shortcode.
- Consider deactivating the plugin on sites where it is not business-critical.
- Monitor the Patchstack and WordPress.org pages for the fixed release.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack: WordPress Passster plugin <= 4.3.21 - Cross Site Scripting (XSS) patchstack.com
- WordPress.org: Passster plugin (content-protector) wordpress.org
- Strix: CVE-2026-125454 www.strix.ai
- Tenable: CVE-2025-14865 www.tenable.com
- Patchstack: Passster XSS advisory for version 4.2.18 patchstack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:26.
Original description (NVD)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Passster content-protector allows Stored XSS.This issue affects Passster: from n/a through 4.3.21.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.