CVE-2025-14865 Details

A stored cross-site scripting vulnerability has been identified in the Passster – Password Protect Pages and Content plugin for WordPress, affecting all versions through 4.2.24. The vulnerability arises from the 'content_protector' shortcode, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary scripts into pages. These scripts execute when users access the compromised pages. Although version 4.2.21 partially addressed this issue, it remains a concern in earlier versions.

Users are advised to update the Passster – Password Protect Pages and Content plugin to version 4.2.25 or later.