The Passster – Password Protect Pages and Content plugin contains a stored Cross‑Site Scripting flaw that is exploitable through its content_protector shortcode. The flaw allows an authenticated user with Contributor permission or higher to inject arbitrary JavaScript into a protected page. When any visitor loads the affected page the injected script runs in the visitor’s browser, potentially enabling credential theft, session hijacking, or defacement. The weakness corresponds to CWE‑79.

All versions of Passster released up to and including 4.2.24 are affected. The plugin is developed by WPChill and the vulnerability was partially addressed in release 4.2.21, but the issue remains present through 4.2.24. WordPress sites using these versions of the plugin should be checked for the presence of the content_protector shortcode and the extent of protected content.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score of less than 1% signals a low probability of immediate exploitation in the wild. The vulnerability requires authenticated access at the Contributor level, so an attacker must first gain or abuse such an account. Once the malicious code is stored, any user who visits the protected page becomes a victim, meaning that the impact can propagate to all site visitors. The plugin is not listed in CISA’s KEV catalog, but administrators should treat the flaw with the same priority as commercial XSS flaws given the potential for abuse.