Unknown Passster vulnerabilities

7 CVEs affecting Unknown Passster, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-15490, published 2026-09-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-16604, published 2026-08-05. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the protected…
CVE-2026-16603, published 2026-08-05. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and…
CVE-2026-16602, published 2026-08-05. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the…
CVE-2026-17559, published 2026-08-21. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an…
CVE-2025-15674, published 2026-08-06. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected content through the WordPress core REST API…
CVE-2025-15490, published 2026-09-02. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs
CVE-2025-15489, published 2026-09-02. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content