CVE-2026-125409

Name of the Vulnerable Software and Affected Versions Passster – Password Protect Pages and Content versions prior to 4.3.22

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. By embedding a ] character in the metavalue parameter (specifically when metakeyinput is passster id or passster headline), an attacker can prematurely close the opening shortcode tag and append a [/passster] closing tag. This causes the trailing HTML payload to be emitted verbatim by the do shortcode() function, bypassing the escaping in render shortcode(). The injected script executes when any user accesses the page, including editors or administrators previewing a pending post, because filter the content() lacks an edit-permission capability gate.

Recommendations Update to version 4.3.22 or later. Restrict the use of the metavalue parameter for users with contributor-level access until the update is applied.