CVE-2026-125454mediumCWE-79

CVE-2026-125454: medium-severity vulnerability in WP Chill Passster

WordPress Passster plugin <= 4.3.21 - Cross Site Scripting (XSS) vulnerability

Published

Follow this CVE+ Monitor Passster

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

10Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Passster content-protector allows Stored XSS.This issue affects Passster: from n/a through 4.3.21.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Affected products
WP Chill · Passster
Related CVEs — WP Chill Passster

In the same product, most dangerous first.

CVE-2025-64218HIGHWordPress Passster plugin <= 4.2.19 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2026-25036MEDIUMWordPress Passster plugin <= 4.2.25 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-62114MEDIUMWordPress Passster plugin <= 4.3.13 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-57926MEDIUMWordPress Passster Plugin <= 4.2.18 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-110896MEDIUMWordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-121574MEDIUMWordPress Passster plugin <= 4.3.20 - Broken Access Control vulnerabilityEPSS —