CVE-2026-2367

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ays_block' shortcode in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 25, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-236705.7Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feat CVE-2026-236717.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth RFCOM Protocol Driver allow CVE-2026-236727.8Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability CVE-2026-236737.8Out-of-bounds read in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.CVE-2026-236747.5Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-236788.8Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain a command injection vulnerability in the traceroute CVE-2026-236795.5libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a ma CVE-2026-23687.1An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of interceptin CVE-2026-236814.3Due to missing authorization check in a function module in SAP Support Tools Plug-In, an authenticated attacker could invoke specific functi CVE-2026-236834.3SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in es CVE-2026-236845.9A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a cart, it may result in CVE-2026-236854.4Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access could