Unknown Passster vulnerabilities

10 vulnerabilities

Known vulnerabilities in Unknown Passster, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.4CVE-2021-24837passster_projectpasster+2
EPSS score
0.39%
The Passster WordPress plugin before 3.5.5.8 does not escape the area parameter of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.7.5CVE-2021-24881passster_projectpasster+2
EPSS score
0.82%
The Passster WordPress plugin before 3.5.5.9 does not properly check for password, as well as that the post to be viewed is public, allowing unauthenticated users to bypass the protection offered by the plugin, and access arbitrary posts (such as private) content, by sending a specifically crafted request.4.3CVE-2025-15674unknownpassster+1
EPSS score
0.30%
The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of protected pages and posts without knowing the password.5.3CVE-2025-15490unknownpassster+1
EPSS score
0.21%
The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs5.3CVE-2025-15489unknownpassster+1
EPSS score
0.19%
The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content5.9CVE-2022-3206passster_projectpassster+2
EPSS score
0.57%
The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. This puts the password at risk in case the cookies get leaked.7.5CVE-2026-16603unknownpassster+1
EPSS score
0.43%
The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API.7.5CVE-2026-16602unknownpassster+1
EPSS score
0.43%
The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public (draft, private, and pending) posts on sites that have a captcha provider configured.7.5CVE-2026-16604unknownpassster+1
EPSS score
0.43%
The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the protected content without knowing the password.5.3CVE-2026-17559unknownpassster+1
EPSS score
0.35%
The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password-protected posts and pages.