CVE-2026-1320: fallo de gravedad alta en ays-pro Secure Copy Content Protection and…
Secure Copy Content Protection and Content Locking <= 4.9.8 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header
Publicada el · Actualizada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.2epss 0.3%
probabilidad de explotación
0.3%top 82% de las CVE
explotación observada
noninguna fuente lo reporta
The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' HTTP header in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Productos afectados
ays-pro · Secure Copy Content Protection and Content LockingCVEs relacionadas — ays-pro Secure Copy Content Protection and…
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-1404MEDIUMSecure Copy Content Protection and Content Locking <= 4.4.7 - Missing Authorization to Unauthenticated User Email Retrieval via ays_sccp_reports_user_search FunctionEPSS 0.4%CVE-2025-14442MEDIUMSecure Copy Content Protection and Content Locking <= 4.9.2 - Unauthenticated Sensitive Information Exposure via Exposed CSV Export FileEPSS 0.3%CVE-2026-2367MEDIUMSecure Copy Content Protection and Content Locking <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributeEPSS 0.2%CVE-2025-14159MEDIUMSecure Copy Content Protection and Content Locking <= 4.9.2 - Cross-Site Request Forgery to Data ExportEPSS 0.2%