Wp Copyprotect Vulnerabilities

[en] Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole WP-CopyProtect [Protect your blog posts] plugin <= 3.1.0 versions.

Affected:

up to 3.1.0

Fix:

No patched version reported

Disclosed:

Oct 4, 2023

CVE-2023-25025 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole WP-CopyProtect [Protect your blog posts] plugin <= 3.1.0 versions.

Affected:

up to 3.1.0

Fix:

No patched version reported

Disclosed:

Oct 4, 2023

CVE-2023-37995 on NVD →

The WP-CopyProtect [Protect your blog posts] plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.0. This is due to missing or incorrect nonce validation on the CopyProtect_options_page function. This makes it possible for unauthenticated attackers to modify plugin sett...

CVSS:

4.3

Affected:

up to 3.1.0

Fix:

No patched version reported

Disclosed:

Jul 19, 2023

CVE-2023-25025 on NVD →

[en] A vulnerability classified as problematic was found in cchetanonline WP-CopyProtect up to 3.0.0. This vulnerability affects the function CopyProtect_options_page of the file wp-copyprotect.php. The manipulation of the argument CopyProtect_nrc_text leads to cross site scripting. The attack can be initiated remotely...

Affected:

up to 3.1.0

Fixed in:

3.1.0

Disclosed:

Jun 12, 2023

CVE-2015-10118 on NVD →

The WP-CopyProtect plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘CopyProtect_nrc_text’ parameter in versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVSS:

7.2

Affected:

up to 3.1.0

Fixed in:

3.1.0

Disclosed:

Jun 30, 2015

The WP-CopyProtect plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘CopyProtect_nrc_text’ parameter in versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

Affected:

up to 3.1.0

Fixed in:

3.1.0

Disclosed:

Jun 30, 2015

The WP-CopyProtect [Protect your blog posts] plugin for WordPress is vulnerable to a Persistent XSS attack on the settings screen, due to a lack of sanitation of user input, and lack of Cross-Site Request Forgery (CSRF) token (nonce).

Affected:

up to 3.1.0

Fixed in:

3.1.0