nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-6138 CVE-2024-6138
MEDIUM
Secure Copy Content Protection < 4.0.9 - Admin+ Stored XSS
Record summary
CVE-2024-6138 has a selected CVSS score of 6.5 (medium).
Description
The Secure Copy Content Protection and Content Locking WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 11, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Secure Copy Content Protection and Content LockingDefault status: unaffected | CVE List | Before 4.0.9 | affected |
secure_copy_content_protection_and_content_lockingBrowse ays-pro / secure_copy_content_protection_and_content_lockingDefault status: unaffected | CVE List | Before 4.0.9 | affected |
References
2wpscan.comexploitvdb entryTechnical description
https://wpscan.com/vulnerability/9ef2a8d8-39d5-45d3-95de-e7bac4b7382d