CVE-2024-6138: Secure Copy Content Protection < 4.0.9 - Admin+ Stored XSS
The Secure Copy Content Protection and Content Locking WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6138?
The severity of CVE-2024-6138 is categorized as high due to the potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-6138?
To fix CVE-2024-6138, update the Secure Copy Content Protection and Content Locking WordPress plugin to version 4.0.9 or later.
Who is affected by CVE-2024-6138?
CVE-2024-6138 affects high privilege users, including admin roles, who use vulnerable versions of the Secure Copy Content Protection and Content Locking plugin.
What vulnerabilities can CVE-2024-6138 exploit?
CVE-2024-6138 can exploit Stored Cross-Site Scripting vulnerabilities due to improper sanitization and escaping of settings in the plugin.
What is the solution for CVE-2024-6138 mitigation?
The solution for mitigating CVE-2024-6138 is to implement security practices and ensure that the latest version of the plugin is in use.