Secure Copy Content Protection EUVD-2026-36387

Exploitation requires an authenticated WordPress administrator account (CVSS PR:H) - unauthenticated exploitation is not possible. The attack is most impactful in WordPress multisite configurations where the unfiltered_html capability is disabled for administrators, as this is the specific context the plugin's missing sanitization bypasses. Exploitation also requires a second victim with sufficient privilege to visit the affected plugin settings page after the payload is stored (CVSS UI:R). Limiting factors include: high privilege bar (admin credentials must be compromised or attacker must be a legitimate admin acting maliciously), necessity of victim interaction to trigger execution, and the attack being non-automatable per SSVC. Standard single-site WordPress deployments where admins already have unfiltered_html are lower-priority targets since the capability system provides less isolation.

The overall real-world risk is low-to-moderate despite the public POC. CVSS base score of 3.5 (Low) reflects the PR:H requirement - exploitation demands administrative credentials, sharply limiting the attacker pool. EPSS at 0.03% (9th percentile) corroborates minimal observed exploitation interest. SSVC signals partial technical impact and confirms non-automatable exploitation, further deprioritizing this for most threat models. The scenario where this becomes meaningful is in WordPress multisite: a malicious or compromised sub-site admin could inject persistent XSS affecting super-admins or other users browsing affected plugin settings pages. KEV status is absent, meaning no confirmed widespread active exploitation. The primary signal worth noting is POC availability from WPScan, which lowers the barrier for opportunistic attackers. No conflicting data between sources was detected; CVSS vector and description are consistent.

A malicious or compromised WordPress administrator navigates to the Secure Copy Content Protection plugin settings and injects a JavaScript payload into an unsanitized settings field. A super-administrator or another privileged user subsequently visits the settings page, causing their browser to execute the stored script - potentially stealing session cookies, performing actions on their behalf, or creating a new rogue admin account. A publicly available proof-of-concept from WPScan demonstrates this attack path.