CVE-2024-6889

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 4, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-68908.8Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user CVE-2024-68918.8Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow.CVE-2024-68926.1Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application.CVE-2024-68937.5The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticat CVE-2024-68945.4The RD Station plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.3.2 due to insuffic CVE-2024-68956.1Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session t CVE-2024-68965.4The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all vers CVE-2024-68976.4The aThemes Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and CVE-2024-68989.8A vulnerability was found in SourceCodester Record Management System 1.0. It has been classified as critical. This affects an unknown part o CVE-2024-68999.8A vulnerability was found in SourceCodester Record Management System 1.0. It has been declared as critical. This vulnerability affects unkno CVE-2024-69008.8A vulnerability was found in SourceCodester Record Management System 1.0. It has been rated as critical. This issue affects some unknown pro CVE-2024-69018.8A vulnerability classified as critical has been found in SourceCodester Record Management System 1.0. Affected is an unknown function of the