CVE-2021-24333 Information

Description

The Content Copy Protection & Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings not perform any validation and sanitisation on them allowing attackers to make a logged in administrator set arbitrary XSS payloads in them.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Reference

https://m0ze.ru/vulnerability/[2021-03-29]-[WordPress]-[CWE-352]-Content-Copy-Protection-Prevent-Image-Save-WordPress-Plugin-v1.3.txt https://m0ze.ru/vulnerability/[2021-03-29]-[WordPress]-[CWE-79]-Content-Copy-Protection-Prevent-Image-Save-WordPress-Plugin-v1.3.txt https://wpscan.com/vulnerability/c722f8d0-f86b-41c2-9f1f-48e475e22864 https://m0ze.ru/exploit/csrf-prevent-content-copy-image-save-v1.3.html

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

HIGH

Base Score

NONE

Base Severity

6.5