Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: Passster Project Clear all filters
TI-2021-07119 CVE-2021-24837 · GHSA-mj4m-mqjg-cm54

Passster < 3.5.5.8 - Contributor+ Stored Cross-Site Scripting

Priority LOW 25

The Passster WordPress plugin before 3.5.5.8 does not escape the area parameter of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00404 Published 2023-01-23 Fixed in 3.5.5.8
TI-2021-07163 CVE-2021-24881 · GHSA-c58r-vwf8-vx95

Passster < 3.5.5.9 - Protection Bypass & Arbitrary Post Access

Priority HIGH 72

The Passster WordPress plugin before 3.5.5.9 does not properly check for password, as well as that the post to be viewed is public, allowing unauthenticated users to bypass the protection offered by the plugin, and acces…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00826 Published 2023-01-23 Fixed in 3.5.5.9
TI-2022-02961 CVE-2022-3206 · GHSA-7j63-969g-r2jp

Passster < 3.5.5.5.2 - Insecure Storage of Password

Priority LOW 27

The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00586 Published 2022-10-17 Fixed in 3.5.5.5.2 CWE-319