The WordPress plugin Copy Anything to Clipboard allows a contributor or higher privileged user to insert a "success-text" attribute in a shortcode that is stored without proper sanitization or escaping. When the stored value is later rendered in a page, the unfiltered attribute is injected into a client‑side script, enabling the execution of arbitrary JavaScript in the browsing context of any user who views the affected content. This stored XSS can lead to credential theft, session hijacking, or the execution of malicious actions under the privileges of the victim user. The weakness stems from improper neutralization of input when generating web page output.

WordPress sites running Copy Anything to Clipboard for WordPress plugin at versions older than 5.5.5. Any installation that allows contributors to add or edit shortcodes is vulnerable, regardless of the site’s overall WordPress version.

The vulnerability is a high‑severity stored XSS, but no EPSS score is available and the issue is not listed in the CISA KEV catalog. Exploitation requires that an attacker have contributor or higher privileges to inject the malicious attribute; the attack proceeds when a higher‑privileged user views the compromised page. Because the flaw persists in stored data and is executed client‑side, it is easily triggered without requiring additional network or system access. The risk is elevated in environments where contributors have broad editing rights or where multiple users share the same content stream.