Passster – Password Protect Pages and Content Security & Risk Analysis

The content-protector plugin v4.2.29 presents a mixed security posture. While the static analysis shows a high percentage of properly escaped output and no evident dangerous functions or file operations, there are several areas for concern. The presence of 15 REST API routes, with one lacking permission callbacks, and 4 AJAX handlers, all without explicit authentication checks noted, creates a significant attack surface that could be exploited by unauthorized actors. The static analysis also indicates that 100% of SQL queries are not using prepared statements, which is a substantial risk for SQL injection vulnerabilities.

The vulnerability history is particularly concerning, with a total of 10 known CVEs. Although currently unpatched CVEs are reported as 0, the prevalence of medium severity vulnerabilities, including Exposure of Sensitive Information, Cross-site Scripting, Missing Authorization, and Inadequate Encryption Strength, suggests a pattern of past security weaknesses. The fact that the last vulnerability was only in February 2026 further highlights ongoing security challenges. While the plugin has strengths in output escaping and a lack of critical taint flows, the historical vulnerability record and the identified attack surface points necessitate caution.