{"id":"CVE-2021-24333","aliases":["EUVD-2021-11246","GHSA-rv98-qjjx-2qfj"],"status":"published","title":"Content Copy Protection \u0026 Prevent Image Save \u003c= 1.3 - CSRF to Stored Cross-Site Scripting (XSS)","description":"The Content Copy Protection \u0026 Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform any validation and sanitisation on them, allowing attackers to make a logged in administrator set arbitrary XSS payloads in them.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.008,"percentile":0.57029,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352","CWE-79"],"published":"2021-06-01T11:33:31Z","modified":"2026-06-17T03:39:50Z","products":[{"vendor":"content_copy_protection_\\\u0026_prevent_image_save_project","product":"content_copy_protection_\\\u0026_prevent_image_save"},{"vendor":"unknown","product":"content copy protection \u0026 prevent image save"}],"references":[{"url":"https://wpscan.com/vulnerability/c722f8d0-f86b-41c2-9f1f-48e475e22864","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://m0ze.ru/exploit/csrf-prevent-content-copy-image-save-v1.3.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://m0ze.ru/vulnerability/%5B2021-03-29%5D-%5BWordPress%5D-%5BCWE-352%5D-Content-Copy-Protection-Prevent-Image-Save-WordPress-Plugin-v1.3.txt","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://m0ze.ru/vulnerability/%5B2021-03-29%5D-%5BWordPress%5D-%5BCWE-79%5D-Content-Copy-Protection-Prevent-Image-Save-WordPress-Plugin-v1.3.txt","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-24333"},{"url":"https://m0ze.ru/vulnerability/[2021-03-29]-[WordPress]-[CWE-352]-Content-Copy-Protection-Prevent-Image-Save-WordPress-Plugin-v1.3.txt"},{"url":"https://m0ze.ru/vulnerability/[2021-03-29]-[WordPress]-[CWE-79]-Content-Copy-Protection-Prevent-Image-Save-WordPress-Plugin-v1.3.txt"},{"url":"https://github.com/advisories/GHSA-rv98-qjjx-2qfj"}],"sources":{"cve":[{"id":"CVE-2021-24333","title":"Content Copy Protection \u0026 Prevent Image Save \u003c= 1.3 - CSRF to Stored Cross-Site Scripting (XSS)","description":"The Content Copy Protection \u0026 Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform any validation and sanitisation on them, allowing attackers to make a logged in administrator set arbitrary XSS payloads in them.","status":"published","published":"2021-06-01T11:33:31Z","modified":"2024-08-03T19:28:23.4Z","cwes":["CWE-352"],"updated_at":"2026-11-02T14:33:04.679189Z"}],"euvd":[{"id":"EUVD-2021-11246","description":"The Content Copy Protection \u0026 Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform any validation and sanitisation on them, allowing attackers to make a logged in administrator set arbitrary XSS payloads in them.","status":"published","published":"2021-06-01T11:33:31Z","modified":"2024-08-03T19:28:23Z","updated_at":"2026-11-03T03:24:58.504484Z"}],"ghsa":[{"id":"GHSA-rv98-qjjx-2qfj","title":"The Content Copy Protection \u0026 Prevent Image Save WordPress plugin through 1.3 does not check for...","description":"The Content Copy Protection \u0026 Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform any validation and sanitisation on them, allowing attackers to make a logged in administrator set arbitrary XSS payloads in them.","status":"published","published":"2022-05-24T19:03:45Z","modified":"2023-01-27T05:03:20Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:42:13.302487Z"}],"nvd":[{"id":"CVE-2021-24333","description":"The Content Copy Protection \u0026 Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform any validation and sanitisation on them, allowing attackers to make a logged in administrator set arbitrary XSS payloads in them.","status":"published","published":"2021-06-01T14:15:09.467Z","modified":"2026-06-17T03:39:50.957Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-352","CWE-79"],"updated_at":"2026-11-02T14:06:53.987491Z"}]}}