CVE-2021-24881

CVE-2021-24881 affects the Passster WordPress plugin prior to version 3.5.5.9. The issue is that the plugin does not properly validate passwords and the post’s public/private status, allowing unauthenticated users to bypass protections and access arbitrary posts (including private content) via cr...

CVE-2021-24837

The Passster WordPress plugin, prior to version 3.5.5.8, does not escape the area parameter in its shortcode, enabling Cross-Site Scripting if a user with Contributor or higher privileges (up to the Contributor+ level) can trigger it. The CVE-2021-24837 entry is supported by multiple sources indi...