CVE-2025-15489

MediumCVSS 5.3/10Last modified Oct 19, 2026

Description

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Sep 2, 2026
Last modified: Oct 19, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-15496.3A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary CVE-2025-154905.3The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protect CVE-2025-154915.5The Post Slides WordPress plugin through 1.0.1 does not validate some shortcode attributes before using them to generate paths passed to inc CVE-2025-154928.8A vulnerability was detected in RainyGao DocSys up to 2.02.36. The affected element is an unknown function of the file src/com/DocSystem/map CVE-2025-154939.8A flaw has been found in RainyGao DocSys up to 2.02.36. The impacted element is an unknown function of the file src/com/DocSystem/mapping/Re CVE-2025-154948.8A vulnerability has been found in RainyGao DocSys up to 2.02.37. This affects an unknown function of the file com/DocSystem/mapping/UserMapp CVE-2025-154957.2A vulnerability was found in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/editsite.php. The manipulati CVE-2025-154969.8A vulnerability was determined in guchengwuyue yshopmall up to 1.9.1. Affected is the function getPage of the file /api/jobs. This manipulat CVE-2025-154973.8Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resultin CVE-2025-154989.3Pro3W CMS if vulnerable to SQL injection attacks. Improper neutralization of input provided into a login form allows an unauthenticated atta CVE-2025-154999.8A vulnerability has been found in Sangfor Operation and Maintenance Management System up to 3.0.8. This vulnerability affects the function u CVE-2025-15509.8The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .k