CVE-2024-2026: 
WordPress vulnerability analysis and mitigation

The Passster plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-2026) in the plugin's content_protector shortcode affecting all versions up to and including 4.2.6.4. The vulnerability was discovered and reported by Wordfence, with the initial disclosure date of April 9, 2024 (NVD CVE).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the content_protector shortcode. The issue has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (Wordfence Intel).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to data theft, session hijacking, or other client-side attacks (NVD CVE).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack vector is network-accessible (N) with low attack complexity (L), requiring low privileges (L) and no user interaction (N) (Wordfence Intel).

Website administrators running affected versions of the Passster plugin should update to a version newer than 4.2.6.4 as soon as possible. The vulnerability is present in the plugin's source code at class-ps-public.php (WordPress Plugin).