What’s Vulnerable › Vulnerabilities

CVE-2022-3206: Passster < 3.5.5.5.2 - Insecure Storage of Password

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-10-17 · updated 2026-06-17
• Weakness: CWE-319

Description

The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. This puts the password at risk in case the cookies get leaked.

Affected products

• Passster: before 3.5.5.5.2 — fixed in 3.5.5.5.2

How to fix

Upgrade to a fixed version: Passster 3.5.5.5.2. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/a8963750-62bf-403e-a906-94f371ed2a7a
• https://wpscan.com/vulnerability/a8963750-62bf-403e-a906-94f371ed2a7a

Get alerted when CVE-2022-3206 or the next vulnerability affects your stack