CVE-2021-24333

MEDIUM

Content Copy Protection & Prevent Image Save < 1.3 - Cross-Site Request Forgery and Stored Cross-Site Scripting

Title source: llm

Description

The Content Copy Protection & Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform any validation and sanitisation on them, allowing attackers to make a logged in administrator set arbitrary XSS payloads in them.

References (4)

Core 4

Core References

Exploit, Third Party Advisory x_refsource_confirm

https://wpscan.com/vulnerability/c722f8d0-f86b-41c2-9f1f-48e475e22864

Exploit, Third Party Advisory x_refsource_misc

https://m0ze.ru/exploit/csrf-prevent-content-copy-image-save-v1.3.html

Various Sources x_refsource_misc

https://m0ze.ru/vulnerability/%5B2021-03-29%5D-%5BWordPress%5D-%5BCWE-352%5D-Content-Copy-Protection-Prevent-Image-Save-WordPress-Plugin-v1.3.txt

Various Sources x_refsource_misc

https://m0ze.ru/vulnerability/%5B2021-03-29%5D-%5BWordPress%5D-%5BCWE-79%5D-Content-Copy-Protection-Prevent-Image-Save-WordPress-Plugin-v1.3.txt

Scores

CVSS v3 6.5

EPSS 0.0080

EPSS Percentile 52.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Details

CWE

CWE-352 CWE-79

Status published

Products (1)

content_copy_protection_\&_prevent_image_save_project/content_copy_protection_\&_prevent_image_save < 1.3

Published Jun 01, 2021

Tracked Since Feb 18, 2026