The vulnerability arises from improper neutralization of input when generating web pages in the Ays Pro Secure Copy Content Protection and Content Locking plugin. An attacker can store malicious script content that is later rendered to users, allowing the execution of arbitrary JavaScript in the context of those visitors. This can lead to credential theft, session hijacking, or defacement of content. The weakness is a classic injection flaw classified as CWE‑79.

The issue affects the Ays Pro Secure Copy Content Protection and Content Locking plugin in all versions up to and including 4.4.3. WordPress sites running any of these affected versions are at risk.

The CVSS base score of 7.1 indicates a high potential for damage, while the EPSS score of less than 1% suggests a low probability of exploitation observed in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Likely attackers would exploit the flaw by creating or modifying content that a broader user base can view, thereby executing the stored script on the victim’s browser.