Secure Copy Content Protection and Content Locking < 4.1.7 – Admin+ Stored XSS | CVE 2024-6888 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

1. Go to https://example.com/wp-admin/admin.php?page=secure-copy-content-protection&sccp_tab=tab5&status=saved
2. In the "Custom CSS" text area, enter the payload: 

a { background-color: red; }
</style><script>alert(4444)</script>

3. See the XSS on the frontend

Affects Plugins

secure-copy-content-protection

Fixed in 4.1.7

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

bob.matyas@automattic.com

Submitter

Bob Matyas

Submitter website

https://www.bobmatyas.com

Submitter twitter

Verified

Yes

WPVDB ID

f4df74c2-4c95-4d1c-97c1-ebfc225f6b93

Timeline

Publicly Published

2024-08-13 (about 1 year ago)

Added

2024-08-13 (about 1 year ago)

Last Updated

2024-08-13 (about 1 year ago)

Other

Published

Title

Published

2025-02-11

Title

Liveticker (by stklcode) < 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-12-05

Title

NewsMash < 1.0.72 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2014-08-01

Title

Bonuspressx - ar_submit.php n Parameter XSS

Published

2019-08-17

Title

Easy Property Listings < 3.4 - Cross-Site Scripting (XSS)

Published

2022-09-07

Title

Donation Thermometer < 2.1.3 - Admin+ Stored Cross-Site Scripting