CVE-2025-3453

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products – Restrict Content, Protect WooCommerce Category and more plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.7 via the 'password_protected_cookie' function. This makes it possible for unauthenticated attackers to extract sensitive data including all protected site content if the 'Use Transient' setting is enabled.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Apr 17, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-34545.0This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the UR CVE-2025-34558.8The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to unauthorized modification of dat CVE-2025-34563.8On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote acc CVE-2025-34575.4The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'oceanwp_icon' shortcode in all versions CVE-2025-34585.4The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ocean_gallery_id’ parameter in all versions up to CVE-2025-34597.8The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection. This is an instance o CVE-2025-34607.8The Quantenna Wi-Fi chipset ships with a local control script, set_tx_pow, that is vulnerable to command injection. This is an instance of C CVE-2025-34619.8The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication CVE-2025-34628.4"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in AS CVE-2025-34639.4"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulne CVE-2025-34648.4A race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issue, potentially leadin CVE-2025-34657.1Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB CoreSense™ HM, ABB CoreSense™ M10.This i