CVE-2021-24931

The WordPress plugin Secure Copy Content Protection and Content Locking (versions before 2.8.2) is affected by an SQL injection due to unsafely using the sccp_id parameter of the ays_sccp_results_export_file AJAX action. The vulnerability is exploitable by unauthenticated users and can lead to un...

CVE-2021-24484

The CVE-2021-24484 entry concerns the WordPress plugin Secure Copy Content Protection and Content Locking (versions before 2.6.7). The vulnerability arises in the plugin’s get_reports() function, which did not whitelist/validate the orderby parameter before it is used in SQL statements passed to ...

CVE-2024-6888

CVE-2024-6888 affects the WordPress plugin Secure Copy Content Protection and Content Locking before version 4.1.7. The issue arises because the plugin does not sanitize/escape certain settings, enabling Stored XSS by high-privilege users (e.g., administrators) even when unfiltered_html is disall...

CVE-2024-6889

The WordPress plugin Secure Copy Content Protection and Content Locking (versions ≤ 4.1.6) is affected. A vulnerability arises from not sanitising/escaping certain settings, enabling admin-level users to perform Stored XSS even when unfiltered_html is disallowed (e.g., multisite). Affected produc...

CVE-2024-6138

CVE-2024-6138 affects the WordPress plugin Secure Copy Content Protection and Content Locking (versions prior to 4.0.9). The issue arises because the plugin does not sanitize and escape certain settings, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disal...