CVE-2026-1320 — Cross-site Scripting in Secure Copy Content Protection AND Content Locking

CWE-79 — Cross-site Scripting5 documents4 sources
Severity
7.2HIGHNVD
EPSS
0.0%
top 86.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Ays-pro Secure Copy Content Protection AND Content Locking
Timeline
PublishedFeb 12

Description

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' HTTP header in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NExploitability: 3.9 | Impact: 2.7

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-wvx5-w592-wf52: The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' HTT↗2026-02-12
▶
CVEList
Secure Copy Content Protection and Content Locking <= 4.9.8 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header↗2026-02-12
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-1320 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-1320 — Cross-site Scripting | cvebase