CVE-2024-6889: Secure Copy Content Protection and Content Locking < 4.1.7 - Admin+ Stored XSS
The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6889?
CVE-2024-6889 has a severity that poses significant security risks due to the potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-6889?
To fix CVE-2024-6889, update the Secure Copy Content Protection and Content Locking WordPress plugin to version 4.1.7 or later.
Who is affected by CVE-2024-6889?
High privilege users, especially administrators, are affected by CVE-2024-6889 due to inadequate sanitization and escaping of settings.
What types of attacks can originate from CVE-2024-6889?
CVE-2024-6889 can lead to Stored Cross-Site Scripting attacks, enabling attackers to execute malicious scripts in users' browsers.
When was CVE-2024-6889 published?
CVE-2024-6889 was published as a vulnerability in Secure Copy Content Protection and Content Locking prior to version 4.1.7.