WordPress Secure Copy Content Protection and Content Locking plugin < 5.1.5 - Admin+ Stored XSS via ays_sccp_sub_icon_image Parameter vulnerability

Admin+ Stored XSS via ayssccpsubiconimage Parameter vulnerability discovered by Luca Jungnickel in WordPress Plugin Secure Copy Content Protection and Content Locking versions 5.1.5...

CVE-2026-9269: Undefined Security Weakness

The Secure Copy Content Protection and Content Locking WordPress plugin before 5.1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for...

CVE-2026-2367: Improper Neutralization of Input During Web Page Generation

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aysblock' shortcode in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2026-25335: Missing Authorization

Missing Authorization vulnerability in Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Secure Copy Content Protection and Content Locking: from n/a through = 5.0.0...

CVE-2026-1320: Improper Neutralization of Input During Web Page Generation

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' HTTP header in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-14159: Cross-Site Request Forgery (CSRF)

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.2. This is due to missing nonce validation on the 'ayssccpresultsexportfile' AJAX action. This makes it possible for unauthenticated...

CVE-2025-14442: Files or Directories Accessible to External Parties

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage of exported CSV files in a publicly accessible directory with predictable filenames in all versions up to, and including, 4.9.2. This makes it possible for...

CVE-2025-32133: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection allows Stored XSS.This issue affects Secure Copy Content Protection and Content Locking: from n/a through =...

CVE-2025-30905: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection allows Stored XSS.This issue affects Secure Copy Content Protection and Content Locking: from n/a through =...

PT-2025-9174

Name of the Vulnerable Software and Affected Versions Secure Copy Content Protection and Content Locking plugin for WordPress versions prior to 4.4.8 Description The issue allows unauthorized access to data due to a missing capability check on the ays sccp reports user search function. This makes...

CVE-2025-1404: Missing Authorization

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ayssccpreportsusersearch function in all versions up to, and including, 4.4.7. This makes it possible for unauthenticated attackers to...

CVE-2024-47306: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection-subscribe-to-view allows Stored XSS.This issue affects Secure Copy Content Protection and Content Locking:...

CVE-2024-6888: Improper Neutralization of Input During Web Page Generation

The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for...

CVE-2024-6889: Improper Neutralization of Input During Web Page Generation

The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for...

CVE-2024-6138: Improper Neutralization of Input During Web Page Generation

The Secure Copy Content Protection and Content Locking WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for...

PT-2024-24859

Name of the Vulnerable Software and Affected Versions Secure Copy Content Protection and Content Locking versions 3.7.1 and earlier Description The issue is related to a Missing Authorization vulnerability in the Secure Copy Content Protection and Content Locking system. This vulnerability affect...

CVE-2021-24931: Improper Neutralization of Special Elements used in an SQL Command

The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccpid parameter of the ayssccpresultsexportfile AJAX action available to both unauthenticated and authenticated users before using it in a SQL statement, leading to an SQL injection...

PT-2021-16373

Name of the Vulnerable Software and Affected Versions: Secure Copy Content Protection and Content Locking WordPress plugin versions prior to 2.8.2 Description: The issue arises from the failure to escape the sccp id parameter of the "ays sccp results export file" AJAX action, leading to an SQL...

CVE-2021-24484: Improper Neutralization of Special Elements used in an SQL Command

The getreports function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...

PT-2021-16007

Name of the Vulnerable Software and Affected Versions Secure Copy Content Protection and Content Locking WordPress plugin versions prior to 2.6.7 Description The issue arises from the get reports function not validating the orderby parameter before using it in SQL statements, leading to SQL...