Secure Copy Content Protection Vulnerabilities

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ays_block' shortcode in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for a...

CVSS:

6.4

Affected:

up to 5.0.1

Fixed in:

5.0.2

Disclosed:

Feb 24, 2026

CVE-2026-2367 on NVD →

[en] Missing Authorization vulnerability in Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Secure Copy Content Protection and Content Locking: from n/a through <= 5.0.0.

Affected:

up to 5.0.0

Fix:

No patched version reported

Disclosed:

Feb 19, 2026

CVE-2026-25335 on NVD →

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' HTTP header in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to i...

CVSS:

7.2

Affected:

up to 4.9.8

Fixed in:

4.9.9

Disclosed:

Feb 12, 2026

CVE-2026-1320 on NVD →

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 5.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthor...

CVSS:

4.3

Affected:

up to 5.0.0

Fixed in:

5.0.1

Disclosed:

Feb 8, 2026

CVE-2026-25335 on NVD →

[en] The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.2. This is due to missing nonce validation on the 'ays_sccp_results_export_file' AJAX action. This makes it possible for unauthenticated attackers to exp...

Affected:

up to 4.9.3

Fixed in:

4.9.3

Disclosed:

Dec 12, 2025

CVE-2025-14159 on NVD →

[en] The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage of exported CSV files in a publicly accessible directory with predictable filenames in all versions up to, and including, 4.9.2. This makes it possible for unauthenticated atta...

Affected:

up to 4.9.3

Fixed in:

4.9.3

Disclosed:

Dec 12, 2025

CVE-2025-14442 on NVD →

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage of exported CSV files in a publicly accessible directory with predictable filenames in all versions up to, and including, 4.9.2. This makes it possible for unauthenticated attackers...

CVSS:

5.3

Affected:

up to 4.9.2

Fixed in:

4.9.3

Disclosed:

Dec 11, 2025

CVE-2025-14442 on NVD →

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.2. This is due to missing nonce validation on the 'ays_sccp_results_export_file' AJAX action. This makes it possible for unauthenticated attackers to export s...

CVSS:

4.3

Affected:

up to 4.9.2

Fixed in:

4.9.3

Disclosed:

Dec 11, 2025

CVE-2025-14159 on NVD →

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to i...

CVSS:

4.4

Affected:

up to 4.5.5

Fixed in:

4.5.6

Disclosed:

Apr 4, 2025

CVE-2025-32133 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Secure Copy Content Protection and Content Locking allows Stored XSS. This issue affects Secure Copy Content Protection and Content Locking: from n/a through 4.5.1.

Affected:

up to 4.5.6

Fixed in:

4.5.6

Disclosed:

Apr 4, 2025

CVE-2025-32133 on NVD →

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages t...

CVSS:

6.1

Affected:

up to 4.4.3

Fixed in:

4.4.5

Disclosed:

Apr 1, 2025

CVE-2025-30905 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Secure Copy Content Protection and Content Locking allows Stored XSS. This issue affects Secure Copy Content Protection and Content Locking: from n/a through 4.4.3.

Affected:

up to 4.4.5

Fixed in:

4.4.5

Disclosed:

Apr 1, 2025

CVE-2025-30905 on NVD →

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_sccp_reports_user_search() function in all versions up to, and including, 4.4.7. This makes it possible for unauthenticated attackers to retrieve a list o...

CVSS:

5.3

Affected:

up to 4.4.7

Fixed in:

4.4.8

Disclosed:

Feb 28, 2025

CVE-2025-1404 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Copy Content Protection Team Secure Copy Content Protection and Content Locking allows Stored XSS.This issue affects Secure Copy Content Protection and Content Locking: from n/a through 4.2.3.

Affected:

up to 4.2.4

Fixed in:

4.2.4

Disclosed:

Oct 6, 2024

CVE-2024-47306 on NVD →

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 4.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in page...

CVSS:

6.1

Affected:

up to 4.2.3

Fixed in:

4.2.4

Disclosed:

Sep 25, 2024

CVE-2024-47306 on NVD →

[en] The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisit...

Affected:

up to 4.1.7

Fixed in:

4.1.7

Disclosed:

Sep 4, 2024

CVE-2024-6889 on NVD →

[en] The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisit...

Affected:

up to 4.1.7

Fixed in:

4.1.7

Disclosed:

Sep 4, 2024

CVE-2024-6888 on NVD →

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Custom class for tooltip container" field in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated att...

CVSS:

4.4

Affected:

up to 4.1.6

Fixed in:

4.1.7

Disclosed:

Aug 13, 2024

CVE-2024-6889 on NVD →

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS setting in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrat...

CVSS:

4.4

Affected:

up to 4.1.6

Fixed in:

4.1.7

Disclosed:

Aug 13, 2024

CVE-2024-6888 on NVD →

[en] The Secure Copy Content Protection and Content Locking WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisit...

Affected:

up to 4.0.9

Fixed in:

4.0.9

Disclosed:

Jul 11, 2024

CVE-2024-6138 on NVD →

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVSS:

4.4

Affected:

up to 4.0.8

Fixed in:

4.0.9

Disclosed:

Jun 20, 2024

CVE-2024-6138 on NVD →

[en] Missing Authorization vulnerability in Copy Content Protection Team Secure Copy Content Protection and Content Locking.This issue affects Secure Copy Content Protection and Content Locking: from n/a through 3.7.1.

Affected:

up to 3.7.2

Fixed in:

3.7.2

Disclosed:

Jun 9, 2024

CVE-2024-32787 on NVD →

[en] Missing Authorization vulnerability in Copy Content Protection Team Secure Copy Content Protection and Content Locking.This issue affects Secure Copy Content Protection and Content Locking: from n/a through 3.9.0.

Affected:

up to 3.9.1

Fixed in:

3.9.1

Disclosed:

Apr 29, 2024

CVE-2024-33587 on NVD →

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_sccp_option function in versions up to, and including, 3.9.0. This makes it possible for unauthenticated attackers to modify an option. It do...

CVSS:

5.3

Affected:

up to 3.9.0

Fixed in:

3.9.1

Disclosed:

Apr 25, 2024

CVE-2024-33587 on NVD →

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to unauthorized access due to a missing capability check in versions up to, and including, 3.7.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 3.7.1

Fixed in:

3.7.2

Disclosed:

Apr 22, 2024

CVE-2024-32787 on NVD →

[en] The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an SQL injection.

Affected:

up to 2.8.2

Fixed in:

2.8.2

Disclosed:

Dec 6, 2021

CVE-2021-24931 on NVD →

The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an SQL injection.

CVSS:

9.8

Affected:

up to 2.8.1

Fixed in:

2.8.2

Disclosed:

Nov 8, 2021

CVE-2021-24931 on NVD →

[en] The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

Affected:

up to 2.6.7

Fixed in:

2.6.7

Disclosed:

Aug 2, 2021

CVE-2021-24484 on NVD →

The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

CVSS:

7.2

Affected:

up to 2.6.7

Fixed in:

2.6.7

Disclosed:

Jun 29, 2021

CVE-2021-24484 on NVD →

Affected:

up to 4.4.8

Fixed in:

4.4.8

CVE-2025-1404 on NVD →