Copy Anything to Clipboard EUVD-2026-111713

The attacker must hold an authenticated account with the contributor role or higher on the target site, and the vulnerable 'Copy Anything to Clipboard' plugin must be installed at a version before 5.5.5. The attacker injects an unsanitized value into the plugin's shortcode attribute, which is stored and later written back into the page by client-side script. Execution is not automatic: a higher-privileged user (e.g., administrator or editor) must view and interact with the attacker-controlled content (UI:R), so the payload fires only in that victim's browser session. Limiting factors: requires provisioning of contributor+ accounts (not default on sites without open/multi-author registration) and requires victim interaction, which reduces the practical blast radius despite the network attack vector.

This is a medium-severity (CVSS 6.8) authenticated stored XSS with a modest real-world risk profile. The signals align toward lower urgency: EPSS is 0.17% (6th percentile), there is no CISA KEV listing, and no public exploit code was identified - only a WPScan advisory reference. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with the low exploitation probability. One conflict must be flagged: the supplied CVSS vector uses PR:H, but the description states exploitation requires only the contributor role, which is a low-privilege authenticated user - PR:L is more accurate, and the PR:H choice understates how reachable this is on sites that allow contributor-level accounts. Additionally, the supplied vector's C:H/I:H/A:H impact is aggressive for a reflected-into-page stored XSS; the realistic impact is session/content compromise of the viewing admin rather than full host compromise. Net: a legitimate but non-emergency issue - patch on a normal cycle, prioritize if the site provisions contributor+ accounts to semi-trusted users.

A user with contributor-level access on the target WordPress site saves content containing the plugin's shortcode with a malicious, unsanitized attribute value. When a higher-privileged user such as an administrator or editor views and interacts with that content in wp-admin, the stored payload is written back into the page by a client-side script and executes in the victim's authenticated session. No public exploit code was identified at time of analysis.