CVE-2024-6690 WP Content Copy Protection & No Right Click (premium) < 15.3 - Open Redirect

The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to external sites...

CVE-2024-6693 WP Content Copy Protection & No Right Click (premium) <= 15.0 - Admin+ Stored XSS

The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-4579 WP Content Security Plugin <= 2.3 - Unauthenticated Stored Cross-Site Scripting via CSP-Report Fields

The WP Content Security Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blocked-uri and effective-directive parameters in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

PT-2025-21256 · WordPress · Wp Content Security Plugin

Name of the Vulnerable Software and Affected Versions: WP Content Security Plugin versions up to, and including, 2.3 Description: The WP Content Security Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blocked-uri and effective-directive parameters due to insufficient...

CVE-2024-49306

WP Content Copy Protection & No Right Click (WordPress plugin)

The vulnerability of the LiteSpeed Cache plugin for WordPress (LSCWP), a content management system for WordPress websites, allows a hacker to gain unauthorized access to the debug log file “/wp-content/debug.log”.

The vulnerability of the LiteSpeed Cache plugin for WordPress LSCWP, a content management system for WordPress websites, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to the debug log file...

CVE-2024-6687

CVE-2024-6687 affects the WordPress plugin CTT Expresso para WooCommerce (versions ≤ 3.2.12). The flaw exposes sensitive data via /wp-content/uploads/cepw, where generated .pdf and log files containing sender/receiver names, phone numbers, physical addresses, and email addresses are publicly acce...

WordPress plugin WP-Members Membership 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2023-23883

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in David Gwyer WP Content Filter plugin = 3.0.1 versions...

CVE-2023-23883

CVE-2023-23883 : WordPress WP Content Filter plugin versions ≤ 3.0.1 contain a stored XSS vulnerability that requires admin+ privileges . The root cause is a stored XSS in the plugin’s handling of content. Impact per sources includes potential user impact and low overall risk in public contexts. ...

CVE-2022-29451

Cross-Site Request Forgery CSRF leading to Arbitrary File Upload vulnerability in Rara One Click Demo Import plugin = 1.2.9 on WordPress allows attackers to trick logged-in admin users into uploading dangerous files into /wp-content/uploads/ directory...

WordPress plugin Rara One Click Demo Import 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. version 1.2.9 and earlier of the Rara One Click Demo Imports plugin are vulnerable to cross-site request...

CVE-2022-23983

Cross-Site Request Forgery CSRF vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin versions = 3.4.4...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin versions = 3.4.4...

CVE-2022-23983 WordPress WP Content Copy Protection & No Right Click plugin <= 3.4.4 - Cross-Site Request Forgery (CSRF) leads to Settings Update vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin versions = 3.4.4...

CVE-2022-23983

The CVE concerns WordPress WP Content Copy Protection & No Right Click plugin (versions

WordPress 插件代码问题漏洞

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress Directorist plugin has a cross-site request forgery vulnerability, which stems from the fact that the WordPress...

CVE-2021-39333 Hashthemes Demo Importer <= 1.1.1 Improper Access Control Allowing Content Deletion

The Hashthemes Demo Importer Plugin = 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users for access control, allowing them to execute a function that truncated nearly all database tables and removed the contents of...

Code injection

Low privileged users can use the AJAX action 'cppluginsdobuttonjoblatercallback' in the WP Content Copy Protection & No Right Click WordPress plugin before 3.1.5, to install any plugin including a specific version from the WordPress repository, as well as activate arbitrary plugin from then blog,...

Coditor <= 1.1 - Arbitrary File Edition, Deletion and Internal Directory Listing in wp-content

The coditorprocessajax AJAX call is missing any CSRF and authorisation checks, allowing low privilege users subscriber+ to read and edit any files in the wp-content folder, as well as list its content. The PoC will be displayed once the issue has been remediated...