The Secure Copy Content Protection and Content Locking plugin is vulnerable to stored cross‑site scripting because attributes supplied to the ays_block shortcode are neither sanitized nor escaped, allowing authenticated users with contributor or higher privileges to embed arbitrary JavaScript that executes in any visitor's browser. This flaw can compromise user confidentiality, alter site content, and serve as a vector for credential theft or defacement.

WordPress sites that have the Secure Copy Content Protection and Content Locking plugin (a plugin named ays-pro) installed in version 5.0.1 or earlier. The vulnerability is active on every installation that accepts input from users with contributor or higher rights.

The CVSS score of 6.4 indicates moderate severity, while an EPSS score of less than 1% implies a very low current exploitation probability. The flaw is not listed in CISA’s KEV catalog. Attackers must possess a contributor‑level or higher account to inject the malicious payload, so the risk is limited to the site’s internal user base. However, once leveraged, the injected script runs for every page visitor, potentially enabling session hijacking or data exfiltration. The low EPSS does not negate the necessity of addressing the flaw promptly, especially in environments with a broad user compartmentalization or high traffic.