The Secure Copy Content Protection and Content Locking plugin contains a stored cross‑site scripting flaw that arises from using the 'X-Forwarded-For' HTTP header without proper input sanitization or output escaping. Because the plugin persists the header value and later renders it directly, malicious payloads can be stored and executed in the browser of anyone who views the affected page. This allows an unauthenticated attacker to inject arbitrary JavaScript that will run in the context of the victim when the page is accessed.

All WordPress sites that have the Secure Copy Content Protection and Content Locking plugin installed, with version 4.9.8 or earlier, are affected. The vulnerability is limited to that plugin and does not impact other parts of WordPress.

The flaw carries a CVSS score of 7.2, indicating high severity. EPSS is less than 1 %, indicating a very low probability of exploitation, and it is not listed in the CISA KEV catalog. An attacker does not need credentials; they simply send an HTTP request containing a malicious X-Forwarded-For header to the vulnerable site. The request stores the payload, and when a user later accesses a page that displays the stored header, the injected script executes in the user’s browser. The attack vector is typically a crafted HTTP request sent to the target system.