Security Alert Summary
The Secure Copy Content Protection and Content Locking plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the plugin’s ays_block shortcode. Authenticated users with contributor-level access and above can supply attributes that are not properly sanitized or escaped, allowing injection of scripts that execute when a page with the injected content is viewed.
CVE Details
- CVE ID: CVE-2026-2367
- Affected plugin / component: Secure Copy Content Protection and Content Locking plugin for WordPress
- Affected versions: All versions up to, and including, 5.0.1
- Published: February 25, 2026 at 10:16:18 AM UTC
- Last modified: February 25, 2026 at 02:15:29 PM UTC
- CVSS v3.1: Base Score 6.4, Severity MEDIUM, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Authentication / Privileges / User Interaction: Authenticated user required (contributor-level access or higher); Privileges Required: Low; User Interaction: None
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The vulnerability is a stored cross-site scripting (XSS) issue caused by insufficient input sanitization and output escaping of user-supplied attributes passed to the plugin’s ays_block shortcode. Because attribute values are not properly sanitized on input or escaped on output, an authenticated user with contributor-level permissions or higher can include malicious JavaScript in those attributes.
When a page containing the malicious shortcode output is rendered, the injected script runs in the context of site visitors’ browsers. The CVE description specifies the shortcode name (ays_block) and the root cause (insufficient input sanitization and output escaping on user supplied attributes), but does not list specific functions beyond the shortcode or indicate any particular REST API endpoints.
The impact is limited to the ability to execute script in the context of pages that include the injected content. It does not, in the provided data, describe any automatic privilege escalation or remote code execution beyond typical XSS effects.
How This Could Impact Your Website
Consider a small editorial team where the site owner maintains overall control, an editor manages content, and several contributors or external contractors submit posts. A contributor with malicious intent (or whose account is compromised) could add a shortcode attribute containing script payloads into a post or page. When other users—such as editors, administrators, or regular visitors—view that page, the script could run in their browsers.
Practical consequences aligned with the CVSS impacts include limited exposure of confidential data accessible in the browser (for example, session tokens or data displayed on the page), increased risk of targeted phishing or social engineering against internal staff, or actions performed in the context of an authenticated user’s browser. This is consistent with the CVSS confidentiality and integrity impacts being rated as “Low” and availability as “None.”
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (If a fixed version is not specified in the CVE entry, monitor the plugin source and vendor advisories for updates.)
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and content changes for unusual behavior, including unexpected shortcode attributes or modified posts/pages.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/secure-copy-content-protection/tags/4.9.9/public/class-secure-copy-content-protection-public.php#L1043
- https://plugins.trac.wordpress.org/browser/secure-copy-content-protection/tags/4.9.9/public/class-secure-copy-content-protection-public.php#L718
- https://plugins.trac.wordpress.org/changeset/3463092/secure-copy-content-protection
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f138d917-0dc2-4408-aa6a-db1fd0410eb4?source=cve
