Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2025-15489

Passster < 4.2.24 - Password Protection Bypass

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Passster Project Wordpress
Products
Passster Wordpress
CVE-2025-15490

Passster < 4.2.26 - Global Protection Bypass

The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Passster Project Wordpress
Products
Passster Wordpress
CVE-2026-17559

Content Protector (Passster) < 4.3.9 - Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass

The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password-protected posts and pages.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Passster Project Wordpress
Products
Passster Wordpress
CVE-2025-15674

Content Protector (Passster) < 4.3.7 - Contributor+ Protected Content Disclosure via Core REST API

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of protected pages and posts without knowing the password.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Passster Project Wordpress
Products
Passster Wordpress
CVE-2022-3206

Passster < 3.5.5.5.2 - Insecure Storage of Password

The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. This puts the password at risk in case the cookies get leaked.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Passster Project
Products
Passster