EUVD-2026-36387
GHSA-fxh5-p8jw-9g3v
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Admin credentials required (PR:H), victim must view the poisoned settings page (UI:R); limited confidentiality and integrity impact only via XSS script execution.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Secure Copy Content Protection and Content Locking WordPress plugin before 5.1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
AnalysisAI
Stored Cross-Site Scripting in the Secure Copy Content Protection and Content Locking WordPress plugin (all versions before 5.1.5) enables high-privilege users such as administrators to inject persistent malicious scripts through unsanitized plugin settings fields. This is particularly impactful in WordPress multisite environments, where the unfiltered_html capability is typically revoked from administrators, making this bypass noteworthy - the plugin fails to enforce its own output escaping independently of WordPress core capabilities. A publicly available proof-of-concept exists per WPScan, though no confirmed active exploitation (CISA KEV) has been recorded and EPSS places this at the 9th percentile for exploitation probability.
Technical ContextAI
The vulnerability resides in a WordPress plugin (CPE: cpe:2.3:a:unknown:secure_copy_content_protection_and_content_locking:*:*:*:*:*:*:*:*) that provides content copy-protection and locking functionality. The root cause is a failure to sanitize inputs and escape outputs in plugin settings - a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) pattern, though CWE is listed as N/A in the source data. WordPress multisite deployments are the highest-risk context because the unfiltered_html capability is disabled for admins by default in that configuration, meaning the plugin's missing sanitization creates an escalation path that WordPress's own capability system was intended to prevent. The attack vector is network-based (AV:N), requiring no complex conditions (AC:L), but demands high privilege (PR:H) and victim interaction to trigger (UI:R), consistent with a stored XSS payload persisting in settings that another user must subsequently view.
RemediationAI
Vendor-released patch: version 5.1.5. Update the Secure Copy Content Protection and Content Locking plugin to version 5.1.5 or later through the WordPress admin dashboard (Plugins > Installed Plugins > Update) or via WP-CLI with 'wp plugin update'. Details are available in the WPScan advisory at https://wpscan.com/vulnerability/61a3f41d-f031-4dba-b5cf-4ca3bce71b1b/. If immediate patching is not possible, restrict plugin settings access to only fully trusted administrator accounts and audit current plugin settings for any unexpected or injected script content. In multisite environments, review whether sub-site administrators have any access to the affected settings pages; removing that access is a viable temporary compensating control, though it may restrict legitimate plugin management capabilities.
The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id paramet
The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did n
The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some o
The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some o
The Secure Copy Content Protection and Content Locking WordPress plugin before 4.0.9 does not sanitise and escape some o
Share
External POC / Exploit Code
Leaving vuln.today